var-201603-0210
Vulnerability from variot
Messages in Apple iOS before 9.3, OS X before 10.11.4, and watchOS before 2.2 does not properly implement a cryptographic protection mechanism, which allows remote attackers to read message attachments via vectors related to duplicate messages. Apple Mac OS X, iOS and WatchOS are prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass security restrictions and perform unauthorized actions. This may aid in further attacks. Note: This issue was previously titled 'Apple iOS Weak Encryption Security Bypass Vulnerability'. The title has been changed to better reflect the vulnerability information. in the United States. Apple iOS is an operating system developed for mobile devices; Apple OS X is a dedicated operating system developed for Mac computers; watchOS is a smart watch operating system. Messages is one of the application components for sending texts, photos and videos. There are security vulnerabilities in Messages of many Apple products. The vulnerability stems from the incorrect implementation of the encryption protection mechanism in the program. The following products and versions are affected: Apple iOS versions prior to 9.3, OS X versions prior to 10.11.4, and watchOS versions prior to 2.2
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201603-0210", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "watchos", "scope": "lte", "trust": 1.0, "vendor": "apple", "version": "2.1" }, { "model": "mac os x", "scope": "lte", "trust": 1.0, "vendor": "apple", "version": "10.11.3" }, { "model": "iphone os", "scope": "lte", "trust": 1.0, "vendor": "apple", "version": "9.2.1" }, { "model": "mac os x", "scope": "eq", "trust": 0.8, "vendor": "apple", "version": "10.11 to 10.11.3" }, { "model": "ios", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "9.3 (ipad 2 or later )" }, { "model": "ios", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "9.3 (iphone 4s or later )" }, { "model": "ios", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "9.3 (ipod touch first 5 after generation )" }, { "model": "watchos", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "2.2 (apple watch edition)" }, { "model": "watchos", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "2.2 (apple watch hermes)" }, { "model": "watchos", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "2.2 (apple watch sport)" }, { "model": "watchos", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "2.2 (apple watch)" }, { "model": "mac os x", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "10.11.3" }, { "model": "watchos", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "2.1" }, { "model": "iphone os", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "9.2.1" }, { "model": "ipod touch", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "0" }, { "model": "iphone", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "0" }, { "model": "ipad", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "0" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.2" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.2.2" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.2.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.3.5" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.3.4" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.3.3" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.3.2" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.3.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.3" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2.9" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2.8" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2.7" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2.6" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2.5" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2.10" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.2" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.0" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "2.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "2.0" } ], "sources": [ { "db": "BID", "id": "84971" }, { "db": "JVNDB", "id": "JVNDB-2016-001859" }, { "db": "CNNVD", "id": "CNNVD-201603-352" }, { "db": "NVD", "id": "CVE-2016-1788" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/o:apple:mac_os_x", "vulnerable": true }, { "cpe22Uri": "cpe:/o:apple:iphone_os", "vulnerable": true }, { "cpe22Uri": "cpe:/o:apple:watchos", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2016-001859" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Christina Garman, Matthew Green, Gabriel Kaptchuk, Ian Miers, and Michael Rushanan of Johns Hopkins University", "sources": [ { "db": "BID", "id": "84971" } ], "trust": 0.3 }, "cve": "CVE-2016-1788", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "NONE", "baseScore": 2.6, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 4.9, "id": "CVE-2016-1788", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "LOW", "trust": 1.8, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0" }, { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "NONE", "baseScore": 2.6, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 4.9, "id": "VHN-90607", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "LOW", "trust": 0.1, "vectorString": "AV:N/AC:H/AU:N/C:P/I:N/A:N", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "HIGH", "attackVector": "NETWORK", "author": "nvd@nist.gov", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "exploitabilityScore": 2.2, "id": "CVE-2016-1788", "impactScore": 3.6, "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2016-1788", "trust": 1.0, "value": "MEDIUM" }, { "author": "NVD", "id": "CVE-2016-1788", "trust": 0.8, "value": "Low" }, { "author": "CNNVD", "id": "CNNVD-201603-352", "trust": 0.6, "value": "LOW" }, { "author": "VULHUB", "id": "VHN-90607", "trust": 0.1, "value": "LOW" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-90607" }, { "db": "JVNDB", "id": "JVNDB-2016-001859" }, { "db": "CNNVD", "id": "CNNVD-201603-352" }, { "db": "NVD", "id": "CVE-2016-1788" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Messages in Apple iOS before 9.3, OS X before 10.11.4, and watchOS before 2.2 does not properly implement a cryptographic protection mechanism, which allows remote attackers to read message attachments via vectors related to duplicate messages. Apple Mac OS X, iOS and WatchOS are prone to a security-bypass vulnerability. \nAn attacker can exploit this issue to bypass security restrictions and perform unauthorized actions. This may aid in further attacks. \nNote: This issue was previously titled \u0027Apple iOS Weak Encryption Security Bypass Vulnerability\u0027. The title has been changed to better reflect the vulnerability information. in the United States. Apple iOS is an operating system developed for mobile devices; Apple OS X is a dedicated operating system developed for Mac computers; watchOS is a smart watch operating system. Messages is one of the application components for sending texts, photos and videos. There are security vulnerabilities in Messages of many Apple products. The vulnerability stems from the incorrect implementation of the encryption protection mechanism in the program. The following products and versions are affected: Apple iOS versions prior to 9.3, OS X versions prior to 10.11.4, and watchOS versions prior to 2.2", "sources": [ { "db": "NVD", "id": "CVE-2016-1788" }, { "db": "JVNDB", "id": "JVNDB-2016-001859" }, { "db": "BID", "id": "84971" }, { "db": "VULHUB", "id": "VHN-90607" } ], "trust": 1.98 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2016-1788", "trust": 2.8 }, { "db": "SECTRACK", "id": "1035353", "trust": 1.1 }, { "db": "JVN", "id": "JVNVU97668313", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2016-001859", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-201603-352", "trust": 0.7 }, { "db": "SECUNIA", "id": "63459", "trust": 0.6 }, { "db": "BID", "id": "84971", "trust": 0.4 }, { "db": "VULHUB", "id": "VHN-90607", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-90607" }, { "db": "BID", "id": "84971" }, { "db": "JVNDB", "id": "JVNDB-2016-001859" }, { "db": "CNNVD", "id": "CNNVD-201603-352" }, { "db": "NVD", "id": "CVE-2016-1788" } ] }, "id": "VAR-201603-0210", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-90607" } ], "trust": 0.01 }, "last_update_date": "2024-11-23T19:47:50.593000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "Apple security updates", "trust": 0.8, "url": "https://support.apple.com/en-us/HT201222" }, { "title": "APPLE-SA-2016-03-21-1 iOS 9.3", "trust": 0.8, "url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html" }, { "title": "APPLE-SA-2016-03-21-5 OS X El Capitan 10.11.4 and Security Update 2016-002", "trust": 0.8, "url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html" }, { "title": "APPLE-SA-2016-03-21-2 watchOS 2.2", "trust": 0.8, "url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html" }, { "title": "HT206167", "trust": 0.8, "url": "https://support.apple.com/en-us/HT206167" }, { "title": "HT206168", "trust": 0.8, "url": "https://support.apple.com/en-us/HT206168" }, { "title": "HT206166", "trust": 0.8, "url": "https://support.apple.com/en-us/HT206166" }, { "title": "HT206166", "trust": 0.8, "url": "https://support.apple.com/ja-jp/HT206166" }, { "title": "HT206167", "trust": 0.8, "url": "https://support.apple.com/ja-jp/HT206167" }, { "title": "HT206168", "trust": 0.8, "url": "https://support.apple.com/ja-jp/HT206168" }, { "title": "Multiple Apple product Messages Security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=60678" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2016-001859" }, { "db": "CNNVD", "id": "CNNVD-201603-352" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-310", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-90607" }, { "db": "JVNDB", "id": "JVNDB-2016-001859" }, { "db": "NVD", "id": "CVE-2016-1788" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 1.7, "url": "http://lists.apple.com/archives/security-announce/2016/mar/msg00000.html" }, { "trust": 1.7, "url": "http://lists.apple.com/archives/security-announce/2016/mar/msg00001.html" }, { "trust": 1.7, "url": "http://lists.apple.com/archives/security-announce/2016/mar/msg00004.html" }, { "trust": 1.7, "url": "https://support.apple.com/ht206166" }, { "trust": 1.7, "url": "https://support.apple.com/ht206167" }, { "trust": 1.7, "url": "https://support.apple.com/ht206168" }, { "trust": 1.1, "url": "http://www.securitytracker.com/id/1035353" }, { "trust": 0.8, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1788" }, { "trust": 0.8, "url": "http://jvn.jp/vu/jvnvu97668313/index.html" }, { "trust": 0.8, "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1788" }, { "trust": 0.6, "url": "http://secunia.com/advisories/63459" }, { "trust": 0.3, "url": "http://www.apple.com/ios/" }, { "trust": 0.3, "url": "http://www.apple.com/ipad/" }, { "trust": 0.3, "url": "http://www.apple.com/iphone/" }, { "trust": 0.3, "url": "http://www.apple.com/ipodtouch/" }, { "trust": 0.3, "url": "http://www.theregister.co.uk/2016/03/21/zero_day_apple_grapple_dredges_imessage_photos_videos_in_ios_9/" } ], "sources": [ { "db": "VULHUB", "id": "VHN-90607" }, { "db": "BID", "id": "84971" }, { "db": "JVNDB", "id": "JVNDB-2016-001859" }, { "db": "CNNVD", "id": "CNNVD-201603-352" }, { "db": "NVD", "id": "CVE-2016-1788" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-90607" }, { "db": "BID", "id": "84971" }, { "db": "JVNDB", "id": "JVNDB-2016-001859" }, { "db": "CNNVD", "id": "CNNVD-201603-352" }, { "db": "NVD", "id": "CVE-2016-1788" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2016-03-24T00:00:00", "db": "VULHUB", "id": "VHN-90607" }, { "date": "2016-03-21T00:00:00", "db": "BID", "id": "84971" }, { "date": "2016-03-25T00:00:00", "db": "JVNDB", "id": "JVNDB-2016-001859" }, { "date": "2016-03-23T00:00:00", "db": "CNNVD", "id": "CNNVD-201603-352" }, { "date": "2016-03-24T01:59:55.330000", "db": "NVD", "id": "CVE-2016-1788" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2016-12-03T00:00:00", "db": "VULHUB", "id": "VHN-90607" }, { "date": "2016-07-05T21:56:00", "db": "BID", "id": "84971" }, { "date": "2016-03-25T00:00:00", "db": "JVNDB", "id": "JVNDB-2016-001859" }, { "date": "2016-03-24T00:00:00", "db": "CNNVD", "id": "CNNVD-201603-352" }, { "date": "2024-11-21T02:47:05.290000", "db": "NVD", "id": "CVE-2016-1788" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201603-352" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "plural Apple Vulnerability in reading message attachments in product messages", "sources": [ { "db": "JVNDB", "id": "JVNDB-2016-001859" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "encryption problem", "sources": [ { "db": "CNNVD", "id": "CNNVD-201603-352" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.