Sign-up

ID

VAR-201704-0787


CVE

CVE-2017-2431


TITLE

Apple macOS of CoreMedia Vulnerability in arbitrary code execution in components

Trust: 0.8

sources: JVNDB: JVNDB-2017-002397

DESCRIPTION

An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "CoreMedia" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .mov file. Apple macOS is prone to multiple security vulnerabilities. Attackers can exploit these issues to execute arbitrary code, obtain sensitive information, cause a denial-of-service condition, or bypass security restrictions and perform unauthorized actions. This may aid in further attacks. CoreMedia is one of the framework components used to connect media pipelines

Trust: 1.98

sources: NVD: CVE-2017-2431 // JVNDB: JVNDB-2017-002397 // BID: 97140 // VULHUB: VHN-110634

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:eqversion:10.12.3

Trust: 1.4

vendor:applemodel:mac os xscope:lteversion:10.12.3

Trust: 1.0

vendor:webkitmodel:open source project webkitscope:eqversion:0

Trust: 0.3

vendor:ubuntumodel:linuxscope:eqversion:16.10

Trust: 0.3

vendor:ubuntumodel:linux ltsscope:eqversion:16.04

Trust: 0.3

vendor:gentoomodel:linuxscope: - version: -

Trust: 0.3

vendor:applemodel:macosscope:eqversion:10.12.3

Trust: 0.3

vendor:applemodel:security update yosemitescope:neversion:2017-0010

Trust: 0.3

vendor:applemodel:security update el capitanscope:neversion:2017-0010

Trust: 0.3

vendor:applemodel:macosscope:neversion:10.12.4

Trust: 0.3

sources: BID: 97140 // JVNDB: JVNDB-2017-002397 // CNNVD: CNNVD-201704-072 // NVD: CVE-2017-2431

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-2431
value: HIGH

Trust: 1.0

NVD: CVE-2017-2431
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201704-072
value: MEDIUM

Trust: 0.6

VULHUB: VHN-110634
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-2431
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-110634
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-2431
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-110634 // JVNDB: JVNDB-2017-002397 // CNNVD: CNNVD-201704-072 // NVD: CVE-2017-2431

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-110634 // JVNDB: JVNDB-2017-002397 // NVD: CVE-2017-2431

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201704-072

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201704-072

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-002397

PATCH
title:Apple security updatesurl:https://support.apple.com/en-us/HT201222
Trust: 0.8
title:HT207615url:https://support.apple.com/en-us/HT207615
Trust: 0.8
title:HT207615url:https://support.apple.com/ja-jp/HT207615
Trust: 0.8
title:Apple macOS Sierra CoreMedia Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=68965
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2017-002397 // 
            
            
            
            CNNVD: CNNVD-201704-072

EXTERNAL IDS
db:NVDid:CVE-2017-2431
Trust: 2.8
db:BIDid:97140
Trust: 2.0
db:SECTRACKid:1038138
Trust: 1.1
db:JVNid:JVNVU90482935
Trust: 0.8
db:JVNDBid:JVNDB-2017-002397
Trust: 0.8
db:CNNVDid:CNNVD-201704-072
Trust: 0.7
db:VULHUBid:VHN-110634
Trust: 0.1
sources:
            
            
            VULHUB: VHN-110634 // 
            
            
            
            BID: 97140 // 
            
            
            
            JVNDB: JVNDB-2017-002397 // 
            
            
            
            CNNVD: CNNVD-201704-072 // 
            
            
            
            NVD: CVE-2017-2431

REFERENCES
url:http://www.securityfocus.com/bid/97140
Trust: 1.7
url:https://support.apple.com/ht207615
Trust: 1.7
url:http://www.securitytracker.com/id/1038138
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-2431
Trust: 0.8
url:http://jvn.jp/vu/jvnvu90482935/index.html
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-2431
Trust: 0.8
url:https://www.apple.com/
Trust: 0.3
url:http://www.apple.com/macosx/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-110634 // 
            
            
            
            BID: 97140 // 
            
            
            
            JVNDB: JVNDB-2017-002397 // 
            
            
            
            CNNVD: CNNVD-201704-072 // 
            
            
            
            NVD: CVE-2017-2431

CREDITS
Ulf Frisk, Apple, Brandon Azad, an anonymous researcher, Max Bazaliy, beist, Sergey Bylokhov, Simon Huang, pjf, Alex Fishman, Izik Eidus, Pekka Oikarainen, Matias Karhumaa, Marko Laakso, @cocoahuke, kimyok, Craig Arendt, Axis, sss, Orr A, Benjamin Gnahm, I
Trust: 0.3
sources:
            
            
            BID: 97140

SOURCES
db:VULHUBid:VHN-110634
db:BIDid:97140
db:JVNDBid:JVNDB-2017-002397
db:CNNVDid:CNNVD-201704-072
db:NVDid:CVE-2017-2431

LAST UPDATE DATE
2024-11-23T20:41:43.095000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-110634date:2017-07-12T00:00:00
db:BIDid:97140date:2017-06-08T08:02:00
db:JVNDBid:JVNDB-2017-002397date:2017-04-12T00:00:00
db:CNNVDid:CNNVD-201704-072date:2017-04-07T00:00:00
db:NVDid:CVE-2017-2431date:2024-11-21T03:23:30.737

SOURCES RELEASE DATE
db:VULHUBid:VHN-110634date:2017-04-02T00:00:00
db:BIDid:97140date:2017-03-27T00:00:00
db:JVNDBid:JVNDB-2017-002397date:2017-04-12T00:00:00
db:CNNVDid:CNNVD-201704-072date:2017-04-07T00:00:00
db:NVDid:CVE-2017-2431date:2017-04-02T01:59:01.917