{"id": "CVE-2016-4727", "bulletinFamily": "NVD", "title": "CVE-2016-4727", "description": "IOThunderboltFamily in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.", "published": "2016-09-25T10:59:00", "modified": "2017-07-30T01:29:00", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4727", "reporter": "cve@mitre.org", "references": ["https://support.apple.com/HT207170", "http://www.securityfocus.com/bid/93055", "http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html", "http://www.securitytracker.com/id/1036858"], "cvelist": ["CVE-2016-4727"], "type": "cve", "lastseen": "2019-05-29T18:15:37", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "f81d777ac885568ae0774fddfa7a03e1"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cpe23", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvelist", "hash": "b4606f71ab7799399cdb69d57ca5dc6a"}, {"key": "cvss", "hash": "d726e774add6189e33cf2ea0c61a2ba5"}, {"key": "cvss2", "hash": "ce5208699795f3a205feddd180907041"}, {"key": "cvss3", "hash": "26f338b95fa1d6f598ba1e3d1ba2ee53"}, {"key": "cwe", "hash": "bb61a0949f8c36262500079f243672e2"}, {"key": "description", "hash": "6fc75c7231f33f0689b2f598496ae035"}, {"key": "href", "hash": "e6474830245cbae9394d73a7879e6358"}, {"key": "modified", "hash": "d0422161a31e384892332aa5386fa87a"}, {"key": "published", "hash": "48c14c9c1a2f1c2f6476f4c8365a0156"}, {"key": "references", "hash": "e7fb2a3ce8b1c10c19fed15f1b185af7"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "022480148622ca14704e6a1423946cad"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "23d72b4dff5f9a43f97916b2cf1638c338bbba85b8a546150749a90362cb69fc", "viewCount": 0, "enchantments": {"score": {"value": 9.2, "vector": "NONE", "modified": "2019-05-29T18:15:37"}, "dependencies": {"references": [{"type": "zdi", "idList": ["ZDI-16-522"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310807888"]}, {"type": "nessus", "idList": ["MACOS_10_12.NASL"]}], "modified": "2019-05-29T18:15:37"}, "vulnersScore": 9.2}, "objectVersion": "1.3", "cpe": [], "affectedSoftware": [{"name": "apple mac_os_x", "operator": "le", "version": "10.11.6"}], "cvss2": {"cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "cpe23": [], "cwe": ["CWE-119"]}

{"zdi": [{"lastseen": "2016-11-09T00:17:51", "bulletinFamily": "info", "description": "This vulnerability allows local attackers to escalate privileges on vulnerable installations of Apple OS X. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the IOThunderboltFamily kext. The issue lies in the failure to properly initialize memory prior to accessing it. An attacker can leverage this vulnerability to escalate privileges under the context of the kernel.", "modified": "2016-11-09T00:00:00", "published": "2016-09-20T00:00:00", "href": "http://www.zerodayinitiative.com/advisories/ZDI-16-522", "id": "ZDI-16-522", "title": "Apple OS X IOThunderboltFamily Uninitialized Memory Privilege Escalation Vulnerability", "type": "zdi", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "nessus": [{"lastseen": "2020-04-01T00:48:01", "bulletinFamily": "scanner", "description": "The remote host is running a version of Mac OS X that is prior to\n10.10.5, 10.11.x prior to 10.11.6, or is not macOS 10.12. It is,\ntherefore, affected by multiple vulnerabilities in the following\ncomponents :\n\n - apache\n - apache_mod_php\n - Apple HSSPI Support\n - AppleEFIRuntime\n - AppleMobileFileIntegrity\n - AppleUCC\n - Application Firewall\n - ATS\n - Audio\n - Bluetooth\n - cd9660\n - CFNetwork\n - CommonCrypto\n - CoreCrypto\n - CoreDisplay\n - curl\n - Date & Time Pref Pane\n - DiskArbitration\n - File Bookmark\n - FontParser\n - IDS - Connectivity\n - ImageIO\n - Intel Graphics Driver\n - IOAcceleratorFamily\n - IOThunderboltFamily\n - Kerberos v5 PAM module\n - Kernel\n - libarchive\n - libxml2\n - libxpc\n - libxslt\n - mDNSResponder\n - NSSecureTextField\n - Perl\n - S2 Camera\n - Security\n - Terminal\n - WindowServer\n\nNote that successful exploitation of the most serious issues can\nresult in arbitrary code execution.", "modified": "2020-04-02T00:00:00", "id": "MACOS_10_12.NASL", "href": "https://www.tenable.com/plugins/nessus/93685", "published": "2016-09-23T00:00:00", "title": "macOS < 10.12 Multiple Vulnerabilities", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(93685);\n script_version(\"1.12\");\n script_cvs_date(\"Date: 2019/06/19 15:17:43\");\n\n script_cve_id(\n \"CVE-2016-0755\",\n \"CVE-2016-4617\",\n \"CVE-2016-4658\",\n \"CVE-2016-4682\",\n \"CVE-2016-4694\",\n \"CVE-2016-4696\",\n \"CVE-2016-4697\",\n \"CVE-2016-4698\",\n \"CVE-2016-4699\",\n \"CVE-2016-4700\",\n \"CVE-2016-4701\",\n \"CVE-2016-4702\",\n \"CVE-2016-4703\",\n \"CVE-2016-4706\",\n \"CVE-2016-4707\",\n \"CVE-2016-4708\",\n \"CVE-2016-4709\",\n \"CVE-2016-4710\",\n \"CVE-2016-4711\",\n \"CVE-2016-4712\",\n \"CVE-2016-4713\",\n \"CVE-2016-4715\",\n \"CVE-2016-4716\",\n \"CVE-2016-4717\",\n \"CVE-2016-4718\",\n \"CVE-2016-4722\",\n \"CVE-2016-4723\",\n \"CVE-2016-4724\",\n \"CVE-2016-4725\",\n \"CVE-2016-4726\",\n \"CVE-2016-4727\",\n \"CVE-2016-4736\",\n \"CVE-2016-4738\",\n \"CVE-2016-4739\",\n \"CVE-2016-4742\",\n \"CVE-2016-4745\",\n \"CVE-2016-4748\",\n \"CVE-2016-4750\",\n \"CVE-2016-4752\",\n \"CVE-2016-4753\",\n \"CVE-2016-4755\",\n \"CVE-2016-4771\",\n \"CVE-2016-4772\",\n \"CVE-2016-4773\",\n \"CVE-2016-4774\",\n \"CVE-2016-4775\",\n \"CVE-2016-4776\",\n \"CVE-2016-4777\",\n \"CVE-2016-4778\",\n \"CVE-2016-4779\",\n \"CVE-2016-5131\",\n \"CVE-2016-5768\",\n \"CVE-2016-5769\",\n \"CVE-2016-5770\",\n \"CVE-2016-5771\",\n \"CVE-2016-5772\",\n \"CVE-2016-5773\",\n \"CVE-2016-6174\",\n \"CVE-2016-6288\",\n \"CVE-2016-6289\",\n \"CVE-2016-6290\",\n \"CVE-2016-6291\",\n \"CVE-2016-6292\",\n \"CVE-2016-6294\",\n \"CVE-2016-6295\",\n \"CVE-2016-6296\",\n \"CVE-2016-6297\",\n \"CVE-2016-7580\",\n \"CVE-2016-7582\"\n );\n script_bugtraq_id(\n 82307,\n 91396,\n 91397,\n 91398,\n 91399,\n 91401,\n 91403,\n 91732,\n 92053,\n 92073,\n 92074,\n 92078,\n 92094,\n 92095,\n 92097,\n 92099,\n 92111,\n 92115,\n 93054,\n 93055,\n 93056,\n 93059,\n 93060,\n 93063,\n 93852,\n 94434,\n 94435,\n 96329\n );\n script_xref(name:\"APPLE-SA\", value:\"APPLE-SA-2016-09-20\");\n\n script_name(english:\"macOS < 10.12 Multiple Vulnerabilities\");\n script_summary(english:\"Checks the version of Mac OS X / macOS.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote host is missing a macOS update that fixes multiple security\nvulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running a version of Mac OS X that is prior to\n10.10.5, 10.11.x prior to 10.11.6, or is not macOS 10.12. It is,\ntherefore, affected by multiple vulnerabilities in the following\ncomponents :\n\n - apache\n - apache_mod_php\n - Apple HSSPI Support\n - AppleEFIRuntime\n - AppleMobileFileIntegrity\n - AppleUCC\n - Application Firewall\n - ATS\n - Audio\n - Bluetooth\n - cd9660\n - CFNetwork\n - CommonCrypto\n - CoreCrypto\n - CoreDisplay\n - curl\n - Date & Time Pref Pane\n - DiskArbitration\n - File Bookmark\n - FontParser\n - IDS - Connectivity\n - ImageIO\n - Intel Graphics Driver\n - IOAcceleratorFamily\n - IOThunderboltFamily\n - Kerberos v5 PAM module\n - Kernel\n - libarchive\n - libxml2\n - libxpc\n - libxslt\n - mDNSResponder\n - NSSecureTextField\n - Perl\n - S2 Camera\n - Security\n - Terminal\n - WindowServer\n\nNote that successful exploitation of the most serious issues can\nresult in arbitrary code execution.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.apple.com/en-us/HT207170\");\n # https://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?c49c769b\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to macOS version 10.12 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2016-4658\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"d2_elliot_name\", value:\"IPS Community Suite RCE\");\n script_set_attribute(attribute:\"exploit_framework_d2_elliot\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/09/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/09/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/09/23\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"combined\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:apple:mac_os_x\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:apple:macos\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"os_fingerprint.nasl\");\n script_require_ports(\"Host/MacOSX/Version\", \"Host/OS\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\nos = get_kb_item(\"Host/MacOSX/Version\");\nif (!os)\n{\n os = get_kb_item_or_exit(\"Host/OS\");\n if (\"Mac OS X\" >!< os) audit(AUDIT_OS_NOT, \"macOS / Mac OS X\");\n\n c = get_kb_item(\"Host/OS/Confidence\");\n if (c <= 70) exit(1, \"Can't determine the host's OS with sufficient confidence.\");\n}\nif (!os) audit(AUDIT_OS_NOT, \"macOS / Mac OS X\");\n\nmatches = pregmatch(pattern:\"Mac OS X ([0-9]+(\\.[0-9]+)+)\", string:os);\nif (isnull(matches)) exit(1, \"Failed to parse the macOS / Mac OS X version ('\" + os + \"').\");\n\nversion = matches[1];\nfixed_version = \"10.12\";\n\n# Patches exist for OS X Yosemite v10.10.5 and OS X El Capitan v10.11.6\n# https://support.apple.com/en-us/HT207275\n# Do NOT mark them as vuln\nif (\n # No 10.x patch below 10.10.5\n ver_compare(ver:version, fix:'10.10.5', strict:FALSE) == -1\n ||\n # No 10.11.x patch below 10.11.6\n (\n version =~\"^10\\.11($|[^0-9])\"\n &&\n ver_compare(ver:version, fix:'10.11.6', strict:FALSE) == -1\n )\n)\n{\n security_report_v4(\n port:0,\n severity:SECURITY_HOLE,\n extra:\n '\\n Installed version : ' + version +\n '\\n Fixed version : ' + fixed_version +\n '\\n'\n );\n}\nelse audit(AUDIT_INST_VER_NOT_VULN, \"macOS / Mac OS X\", version);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "openvas": [{"lastseen": "2019-05-29T18:35:01", "bulletinFamily": "scanner", "description": "This host is running Apple Mac OS X and\n is prone to multiple vulnerabilities.", "modified": "2019-05-03T00:00:00", "published": "2016-09-28T00:00:00", "id": "OPENVAS:1361412562310807888", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310807888", "title": "Apple Mac OS X Multiple Vulnerabilities-01 September-2016", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Apple Mac OS X Multiple Vulnerabilities-01 September-2016\n#\n# Authors:\n# Shakeel <bshakeel@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.807888\");\n script_version(\"2019-05-03T08:55:39+0000\");\n script_cve_id(\"CVE-2016-4694\", \"CVE-2016-5768\", \"CVE-2016-5769\", \"CVE-2016-5770\",\n \"CVE-2016-5771\", \"CVE-2016-5772\", \"CVE-2016-5773\", \"CVE-2016-6174\",\n \"CVE-2016-6288\", \"CVE-2016-6289\", \"CVE-2016-6290\", \"CVE-2016-6291\",\n \"CVE-2016-6292\", \"CVE-2016-6294\", \"CVE-2016-6295\", \"CVE-2016-6296\",\n \"CVE-2016-6297\", \"CVE-2016-4697\", \"CVE-2016-4696\", \"CVE-2016-4698\",\n \"CVE-2016-4699\", \"CVE-2016-4700\", \"CVE-2016-4701\", \"CVE-2016-4779\",\n \"CVE-2016-4702\", \"CVE-2016-4703\", \"CVE-2016-4706\", \"CVE-2016-4707\",\n \"CVE-2016-4708\", \"CVE-2016-4711\", \"CVE-2016-4712\", \"CVE-2016-4713\",\n \"CVE-2016-0755\", \"CVE-2016-4715\", \"CVE-2016-4716\", \"CVE-2016-4717\",\n \"CVE-2016-4718\", \"CVE-2016-4722\", \"CVE-2016-4723\", \"CVE-2016-4724\",\n \"CVE-2016-4725\", \"CVE-2016-4726\", \"CVE-2016-4727\", \"CVE-2016-4745\",\n \"CVE-2016-4771\", \"CVE-2016-4772\", \"CVE-2016-4773\", \"CVE-2016-4774\",\n \"CVE-2016-4776\", \"CVE-2016-4775\", \"CVE-2016-4777\", \"CVE-2016-4778\",\n \"CVE-2016-4736\", \"CVE-2016-4658\", \"CVE-2016-5131\", \"CVE-2016-4738\",\n \"CVE-2016-4739\", \"CVE-2016-4742\", \"CVE-2016-4748\", \"CVE-2016-4750\",\n \"CVE-2016-4752\", \"CVE-2016-4753\", \"CVE-2016-4755\", \"CVE-2016-4709\",\n \"CVE-2016-4710\");\n script_bugtraq_id(93063, 91396, 92074, 92073, 93054, 93055, 92095, 92094, 92097,\n 93059, 92078, 92053, 91732, 91399, 91398, 91397, 92099, 82307,\n 92111, 91403, 92115, 91401, 93060, 93056);\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-05-03 08:55:39 +0000 (Fri, 03 May 2019)\");\n script_tag(name:\"creation_date\", value:\"2016-09-28 12:22:55 +0530 (Wed, 28 Sep 2016)\");\n script_name(\"Apple Mac OS X Multiple Vulnerabilities-01 September-2016\");\n\n script_tag(name:\"summary\", value:\"This host is running Apple Mac OS X and\n is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists. For details\n refer the reference links.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attacker\n to execute arbitrary code or cause a denial of service (memory corruption),\n gain access to potentially sensitive information, bypass certain protection\n mechanism and have other impacts.\");\n\n script_tag(name:\"affected\", value:\"Apple Mac OS X versions 10.7.5 through 10.11.x\n prior to 10.12\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Apple Mac OS X version\n 10.12 or later. Please see the references for more information.\n\n Note: According to the vendor an upgrade to version 10.12 is required to\n mitigate this vulnerabilities. Please see the advisory (HT207170) for more info.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"https://support.apple.com/en-us/HT207170\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Mac OS X Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/osx_name\", \"ssh/login/osx_version\", re:\"ssh/login/osx_version=^10\\.([7-9]|1[01])\");\n\n exit(0);\n}\n\ninclude(\"version_func.inc\");\n\nosName = get_kb_item(\"ssh/login/osx_name\");\nif(!osName)\n exit(0);\n\nosVer = get_kb_item(\"ssh/login/osx_version\");\nif(!osVer)\n exit(0);\n\nif(\"Mac OS X\" >< osName && osVer =~ \"^10\\.([7-9]|1[01])\"){\n if(version_in_range(version:osVer, test_version: \"10.7.5\", test_version2:\"10.11.6\")){\n report = report_fixed_ver(installed_version:osVer, fixed_version:\"According to the vendor an upgrade to version 10.12 is required to mitigate this vulnerabilities. Please see the advisory (HT207170) for more info.\");\n security_message(port:0, data:report);\n exit(0);\n }\n}\n\nexit(99);", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}