ID CVE-2016-4763
Summary WKWebView in WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly verify X.509 certificates from HTTPS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
References
Vulnerable Configurations
  • Apple iTunes 12.4.3
    cpe:2.3:a:apple:itunes:12.4.3
  • Microsoft Windows
    cpe:2.3:o:microsoft:windows
  • Apple Safari 9.1.3
    cpe:2.3:a:apple:safari:9.1.3
  • Apple iPhone OS 9.3.5
    cpe:2.3:o:apple:iphone_os:9.3.5
CVSS
Base: 4.9 (as of 26-09-2016 - 17:09)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK MEDIUM SINGLE_INSTANCE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL NONE
nessus via4
  • NASL family Peer-To-Peer File Sharing
    NASL id ITUNES_12_5_1_BANNER.NASL
    description The version of Apple iTunes running on the remote Windows host is prior to 12.5.1. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists due to improper handling of error prototypes. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a maliciously crafted website, to execute arbitrary code. (CVE-2016-4728) - An information disclosure vulnerability exists in WebKit due to a permission issue caused by improper handling of the location variable. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a maliciously crafted website, to disclose sensitive information. (CVE-2016-4758) - Multiple memory corruption errors exist in WebKit due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these issues, by convincing a user to visit a maliciously crafted website, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-4759, CVE-2016-4762, CVE-2016-4764, CVE-2016-4765, CVE-2016-4766, CVE-2016-4767, CVE-2016-4768, CVE-2016-4769) - A rebinding flaw exists in WebKit due to a failure to restrict HTTP/0.9 responses to default ports and cancel resource loads if a document is loaded with a different HTTP protocol version. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a maliciously crafted website, to access non-HTTP services. (CVE-2016-4760) - A security bypass vulnerability exists in WebKit in the WKWebView component due to a failure to properly verify X.509 certificates from HTTPS servers. A man-in-the-middle attacker can exploit this, via a specially crafted certificate, to spoof servers and disclose or manipulate network traffic. (CVE-2016-4763) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 94971
    published 2016-11-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=94971
    title Apple iTunes < 12.5.1 Multiple Vulnerabilities (uncredentialed Check)
  • NASL family Windows
    NASL id ITUNES_12_5_1.NASL
    description The version of Apple iTunes installed on the remote Windows host is prior to 12.5.1. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists due to improper handling of error prototypes. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a maliciously crafted website, to execute arbitrary code. (CVE-2016-4728) - An information disclosure vulnerability exists in WebKit due to a permission issue caused by improper handling of the location variable. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a maliciously crafted website, to disclose sensitive information. (CVE-2016-4758) - Multiple memory corruption errors exist in WebKit due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these issues, by convincing a user to visit a maliciously crafted website, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-4759, CVE-2016-4762, CVE-2016-4764, CVE-2016-4765, CVE-2016-4766, CVE-2016-4767, CVE-2016-4768, CVE-2016-4769) - A rebinding flaw exists in WebKit due to a failure to restrict HTTP/0.9 responses to default ports and cancel resource loads if a document is loaded with a different HTTP protocol version. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a maliciously crafted website, to access non-HTTP services. (CVE-2016-4760) - A security bypass vulnerability exists in WebKit in the WKWebView component due to a failure to properly verify X.509 certificates from HTTPS servers. A man-in-the-middle attacker can exploit this, via a specially crafted certificate, to spoof servers and disclose or manipulate network traffic. (CVE-2016-4763) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 94914
    published 2016-11-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=94914
    title Apple iTunes < 12.5.1 Multiple Vulnerabilities (credentialed check)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SAFARI10_0.NASL
    description The version of Apple Safari installed on the remote Mac OS X or macOS host is prior to 10.0. It is, therefore, affected by multiple vulnerabilities : - Multiple memory corruption issues exist in WebKit that allow an unauthenticated, remote attacker to cause a denial of service condition or execute arbitrary code via specially a crafted website. (CVE-2016-4611, CVE-2016-4729, CVE-2016-4730, CVE-2016-4731, CVE-2016-4734, CVE-2016-4735, CVE-2016-4737, CVE-2016-4759, CVE-2016-4762, CVE-2016-4766, CVE-2016-4767, CVE-2016-4768, CVE-2016-4769) - A cross-site scripting (XSS) vulnerability exists in the Reader feature due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user to follow a specially crafted link, to execute arbitrary script code in a user's browser session. (CVE-2016-4618) - A flaw exists in WebKit due to improper handling of error prototypes. An unauthenticated, remote attacker can exploit this, via a specially crafted website, to execute arbitrary code. (CVE-2016-4728) - Multiple flaws exist in WebKit due to improper state management. An unauthenticated, remote attacker can exploit this, via a specially crafted website, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-4733, CVE-2016-4765) - An address bar spoofing vulnerability exists due to a state management flaw related to sessions in tabs. An unauthenticated, remote attacker can exploit this, via a specially crafted website, to spoof an address in the address bar. (CVE-2016-4751) - A flaw exists in WebKit due to improper handling of the location variable. An unauthenticated, remote attacker can exploit this, via a crafted website, to disclose sensitive information. (CVE-2016-4758) - A flaw exists in WebKit that allows an unauthenticated, remote attacker to conduct DNS rebinding attacks against non-HTTP Safari sessions by leveraging HTTP/0.9 support. (CVE-2016-4760) - A flaw exists in WebKit in the WKWebView component due to improper validation of X.509 certificates from HTTPS servers. A man-in-the-middle attacker can exploit this, via a crafted certificate, to disclose sensitive information. (CVE-2016-4763)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 93721
    published 2016-09-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93721
    title Mac OS X : Apple Safari < 10.0 Multiple Vulnerabilities
refmap via4
apple
  • APPLE-SA-2016-09-20-2
  • APPLE-SA-2016-09-20-3
  • APPLE-SA-2016-09-20-7
bid 93066
confirm
sectrack 1036854
Last major update 28-11-2016 - 15:21
Published 25-09-2016 - 06:59
Last modified 29-07-2017 - 21:29
Back to Top