Sign-up

ID

VAR-201702-0258


CVE

CVE-2016-7661


TITLE

plural Apple Vulnerability gained in the power management component of a product

Trust: 0.8

sources: JVNDB: JVNDB-2016-007466

DESCRIPTION

An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. The issue involves the "Power Management" component. It allows local users to gain privileges via unspecified vectors related to Mach port name references. Apple macOS, iOS and tvOS are prone to multiple security vulnerabilities. Attackers can exploit these issues to execute arbitrary code with elevated privileges, obtain sensitive information and overwrite arbitrary files. Failed exploit attempts may result in a denial-of-service condition. Versions prior to iOS 10.2, macOS 10.12.2 and tvOS 10.1 are vulnerable. in the United States. Apple iOS is an operating system developed for mobile devices; macOS Sierra is an operating system developed for Mac computers. A local attacker can exploit this vulnerability to gain root privileges

Trust: 1.98

sources: NVD: CVE-2016-7661 // JVNDB: JVNDB-2016-007466 // BID: 94906 // VULHUB: VHN-96481

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:eqversion:10.12.1

Trust: 1.4

vendor:applemodel:iphone osscope:lteversion:10.1.1

Trust: 1.0

vendor:applemodel:mac os xscope:lteversion:10.12.1

Trust: 1.0

vendor:applemodel:iosscope:ltversion:10.2 (ipad first 4 after generation )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:10.2 (iphone 5 or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:10.2 (ipod touch first 6 after generation )

Trust: 0.8

vendor:applemodel:tvosscope:ltversion:10.1 (apple tv first 4 generation )

Trust: 0.8

vendor:applemodel:iphone osscope:eqversion:10.1.1

Trust: 0.6

vendor:applemodel:tvosscope:eqversion:10.0.1

Trust: 0.3

vendor:applemodel:tvosscope:eqversion:9.2.2

Trust: 0.3

vendor:applemodel:tvosscope:eqversion:9.2.1

Trust: 0.3

vendor:applemodel:tvosscope:eqversion:9.1.1

Trust: 0.3

vendor:applemodel:tvosscope:eqversion:9.2

Trust: 0.3

vendor:applemodel:tvosscope:eqversion:9.1

Trust: 0.3

vendor:applemodel:tvosscope:eqversion:9.0

Trust: 0.3

vendor:applemodel:tvosscope:eqversion:10

Trust: 0.3

vendor:applemodel:macosscope:eqversion:10.12.1

Trust: 0.3

vendor:applemodel:macosscope:eqversion:10.12

Trust: 0.3

vendor:applemodel:iosscope:eqversion:50

Trust: 0.3

vendor:applemodel:iosscope:eqversion:40

Trust: 0.3

vendor:applemodel:iosscope:eqversion:30

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.4.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.9

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.10

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10

Trust: 0.3

vendor:applemodel:tvosscope:neversion:10.1

Trust: 0.3

vendor:applemodel:macosscope:neversion:10.12.2

Trust: 0.3

vendor:applemodel:iosscope:neversion:10.2

Trust: 0.3

sources: BID: 94906 // JVNDB: JVNDB-2016-007466 // CNNVD: CNNVD-201612-503 // NVD: CVE-2016-7661

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-7661
value: HIGH

Trust: 1.0

NVD: CVE-2016-7661
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201612-503
value: HIGH

Trust: 0.6

VULHUB: VHN-96481
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2016-7661
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-96481
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-7661
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-96481 // JVNDB: JVNDB-2016-007466 // CNNVD: CNNVD-201612-503 // NVD: CVE-2016-7661

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.9

sources: VULHUB: VHN-96481 // JVNDB: JVNDB-2016-007466 // NVD: CVE-2016-7661

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201612-503

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201612-503

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-007466

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-96481

PATCH
title:Apple security updatesurl:https://support.apple.com/en-us/HT201222
Trust: 0.8
title:APPLE-SA-2016-12-13-1 macOS 10.12.2url:https://lists.apple.com/archives/security-announce/2016/Dec/msg00003.html
Trust: 0.8
title:APPLE-SA-2016-12-12-3 tvOS 10.1url:https://lists.apple.com/archives/security-announce/2016/Dec/msg00002.html
Trust: 0.8
title:APPLE-SA-2016-12-12-1 iOS 10.2url:https://lists.apple.com/archives/security-announce/2016/Dec/msg00000.html
Trust: 0.8
title:HT207422url:https://support.apple.com/en-us/HT207422
Trust: 0.8
title:HT207423url:https://support.apple.com/en-us/HT207423
Trust: 0.8
title:HT207425url:https://support.apple.com/en-us/HT207425
Trust: 0.8
title:HT207422url:https://support.apple.com/ja-jp/HT207422
Trust: 0.8
title:HT207423url:https://support.apple.com/ja-jp/HT207423
Trust: 0.8
title:HT207425url:https://support.apple.com/ja-jp/HT207425
Trust: 0.8
title:Multiple Apple product Power Management Fixes for component security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=66537
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2016-007466 // 
            
            
            
            CNNVD: CNNVD-201612-503

EXTERNAL IDS
db:NVDid:CVE-2016-7661
Trust: 2.8
db:BIDid:94906
Trust: 2.0
db:EXPLOIT-DBid:40931
Trust: 1.1
db:EXPLOIT-DBid:40958
Trust: 1.1
db:SECTRACKid:1037469
Trust: 1.1
db:JVNid:JVNVU93979172
Trust: 0.8
db:JVNid:JVNVU97133642
Trust: 0.8
db:JVNDBid:JVNDB-2016-007466
Trust: 0.8
db:CNNVDid:CNNVD-201612-503
Trust: 0.7
db:PACKETSTORMid:140253
Trust: 0.1
db:VULHUBid:VHN-96481
Trust: 0.1
sources:
            
            
            VULHUB: VHN-96481 // 
            
            
            
            BID: 94906 // 
            
            
            
            JVNDB: JVNDB-2016-007466 // 
            
            
            
            CNNVD: CNNVD-201612-503 // 
            
            
            
            NVD: CVE-2016-7661

REFERENCES
url:http://www.securityfocus.com/bid/94906
Trust: 1.7
url:https://support.apple.com/ht207422
Trust: 1.7
url:https://support.apple.com/ht207423
Trust: 1.7
url:https://www.exploit-db.com/exploits/40931/
Trust: 1.1
url:https://www.exploit-db.com/exploits/40958/
Trust: 1.1
url:http://www.securitytracker.com/id/1037469
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-7661
Trust: 0.8
url:http://jvn.jp/vu/jvnvu93979172/index.html
Trust: 0.8
url:http://jvn.jp/vu/jvnvu97133642/index.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-7661
Trust: 0.8
url:https://support.apple.com/en-in/ht207425
Trust: 0.6
url:http://www.apple.com/ios/
Trust: 0.3
url:http://www.apple.com/accessibility/tvos/
Trust: 0.3
url:http://www.apple.com/macosx/
Trust: 0.3
url:http://prod.lists.apple.com/archives/security-announce/2016/dec/msg00003.html
Trust: 0.3
url:http://prod.lists.apple.com/archives/security-announce/2016/dec/msg00007.html
Trust: 0.3
url:http://prod.lists.apple.com/archives/security-announce/2016/dec/msg00008.html
Trust: 0.3
sources:
            
            
            VULHUB: VHN-96481 // 
            
            
            
            BID: 94906 // 
            
            
            
            JVNDB: JVNDB-2016-007466 // 
            
            
            
            CNNVD: CNNVD-201612-503 // 
            
            
            
            NVD: CVE-2016-7661

CREDITS
Ian Beer of Google Project Zero, Keen Lab working with Trend Micro's Zero DayInitiative
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-201612-503

SOURCES
db:VULHUBid:VHN-96481
db:BIDid:94906
db:JVNDBid:JVNDB-2016-007466
db:CNNVDid:CNNVD-201612-503
db:NVDid:CVE-2016-7661

LAST UPDATE DATE
2024-11-23T19:27:38.870000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-96481date:2017-09-03T00:00:00
db:BIDid:94906date:2016-12-20T00:09:00
db:JVNDBid:JVNDB-2016-007466date:2017-03-01T00:00:00
db:CNNVDid:CNNVD-201612-503date:2017-03-01T00:00:00
db:NVDid:CVE-2016-7661date:2024-11-21T02:58:23.667

SOURCES RELEASE DATE
db:VULHUBid:VHN-96481date:2017-02-20T00:00:00
db:BIDid:94906date:2016-12-13T00:00:00
db:JVNDBid:JVNDB-2016-007466date:2017-03-01T00:00:00
db:CNNVDid:CNNVD-201612-503date:2016-12-15T00:00:00
db:NVDid:CVE-2016-7661date:2017-02-20T08:59:04.230