Sign-up

ID

VAR-201607-0301


CVE

CVE-2016-4645


TITLE

Apple OS X of CFNetwork Vulnerability in which important information is obtained

Trust: 0.8

sources: JVNDB: JVNDB-2016-004018

DESCRIPTION

CFNetwork in Apple OS X before 10.11.6 uses weak permissions for web-browser cookies, which allows local users to obtain sensitive information via unspecified vectors. Apple Mac OS X is prone to multiple security vulnerabilities. Attackers can exploit these issues to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks. Apple Mac OS X 10.9.5, 10.10.5 and 10.11 through 10.11.5 are vulnerable. CFNetwork is a low-level, high-performance framework, an extension of BSD sockets (sockets), which enables users to flexibly manipulate the protocol stack, and provides standardized abstract APIs to simplify FTP HTTP server interaction tasks, resolve DNS host resolution, etc. A local attacker could exploit this vulnerability to obtain sensitive information

Trust: 2.07

sources: NVD: CVE-2016-4645 // JVNDB: JVNDB-2016-004018 // BID: 91824 // VULHUB: VHN-93464 // VULMON: CVE-2016-4645

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:lteversion:10.11.5

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.11 and later

Trust: 0.8

vendor:applemodel:mac os xscope:eqversion:10.11.5

Trust: 0.6

vendor:applemodel:mac osscope:eqversion:x10.11.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.11.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.11.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.10.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.9.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.11.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.11.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.11

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.11.6

Trust: 0.3

vendor:applemodel:mac os security updatescope:neversion:x2016

Trust: 0.3

sources: BID: 91824 // JVNDB: JVNDB-2016-004018 // CNNVD: CNNVD-201607-894 // NVD: CVE-2016-4645

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-4645
value: LOW

Trust: 1.0

NVD: CVE-2016-4645
value: LOW

Trust: 0.8

CNNVD: CNNVD-201607-894
value: LOW

Trust: 0.6

VULHUB: VHN-93464
value: LOW

Trust: 0.1

VULMON: CVE-2016-4645
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2016-4645
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-93464
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-4645
baseSeverity: LOW
baseScore: 3.3
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 1.4
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-93464 // VULMON: CVE-2016-4645 // JVNDB: JVNDB-2016-004018 // CNNVD: CNNVD-201607-894 // NVD: CVE-2016-4645

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.9

sources: VULHUB: VHN-93464 // JVNDB: JVNDB-2016-004018 // NVD: CVE-2016-4645

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201607-894

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201607-894

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-004018

PATCH
title:Apple security updatesurl:https://support.apple.com/en-us/HT201222
Trust: 0.8
title:APPLE-SA-2016-07-18-1 OS X El Capitan v10.11.6 and Security Update 2016-004url:http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
Trust: 0.8
title:HT206903url:https://support.apple.com/en-us/HT206903
Trust: 0.8
title:HT206903url:https://support.apple.com/ja-jp/HT206903
Trust: 0.8
title:Apple OS X CFNetwork Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=63254
Trust: 0.6
title:Apple: OS X El Capitan v10.11.6 and Security Update 2016-004url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=0d15a2e676b3d7c13f2468e8bb26534c
Trust: 0.1
sources:
            
            
            VULMON: CVE-2016-4645 // 
            
            
            
            JVNDB: JVNDB-2016-004018 // 
            
            
            
            CNNVD: CNNVD-201607-894

EXTERNAL IDS
db:NVDid:CVE-2016-4645
Trust: 2.9
db:BIDid:91824
Trust: 1.5
db:SECTRACKid:1036348
Trust: 1.2
db:JVNid:JVNVU94844193
Trust: 0.8
db:JVNDBid:JVNDB-2016-004018
Trust: 0.8
db:CNNVDid:CNNVD-201607-894
Trust: 0.7
db:ZDIid:ZDI-16-439
Trust: 0.6
db:ZDIid:ZDI-16-496
Trust: 0.3
db:ZDIid:ZDI-16-437
Trust: 0.3
db:ZDIid:ZDI-16-431
Trust: 0.3
db:ZDIid:ZDI-16-435
Trust: 0.3
db:VULHUBid:VHN-93464
Trust: 0.1
db:VULMONid:CVE-2016-4645
Trust: 0.1
sources:
            
            
            VULHUB: VHN-93464 // 
            
            
            
            VULMON: CVE-2016-4645 // 
            
            
            
            BID: 91824 // 
            
            
            
            JVNDB: JVNDB-2016-004018 // 
            
            
            
            CNNVD: CNNVD-201607-894 // 
            
            
            
            NVD: CVE-2016-4645

REFERENCES
url:http://lists.apple.com/archives/security-announce/2016/jul/msg00000.html
Trust: 1.8
url:https://support.apple.com/ht206903
Trust: 1.8
url:http://www.securityfocus.com/bid/91824
Trust: 1.2
url:http://www.securitytracker.com/id/1036348
Trust: 1.2
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-4645
Trust: 0.8
url:http://jvn.jp/vu/jvnvu94844193/index.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-4645
Trust: 0.8
url:http://zerodayinitiative.com/advisories/zdi-16-439/
Trust: 0.6
url:https://www.apple.com/
Trust: 0.3
url:http://www.apple.com/macosx/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-431/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-435/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-437/
Trust: 0.3
url:apple os x acmp4aacbasedecoder out-of-bounds read information disclosure vulnerability
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-496/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/200.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://www.rapid7.com/db/vulnerabilities/apple-osx-intelgraphicsdriver-cve-2016-4633
Trust: 0.1
url:https://support.apple.com/kb/ht206903
Trust: 0.1
url:http://tools.cisco.com/security/center/viewalert.x?alertid=47129
Trust: 0.1
sources:
            
            
            VULHUB: VHN-93464 // 
            
            
            
            VULMON: CVE-2016-4645 // 
            
            
            
            BID: 91824 // 
            
            
            
            JVNDB: JVNDB-2016-004018 // 
            
            
            
            CNNVD: CNNVD-201607-894 // 
            
            
            
            NVD: CVE-2016-4645

CREDITS
Jonathan Lewis from DeARX Services (PTY) LTD, Ke Liu of Tencent's Xuanwu Lab, Ian Beer of Google Project Zero, Tyler Bohan of Cisco Talos, Stefan Esser of SektionEins, Yubin Fu of Tencent KeenLab working with TrendMicro's Zero Day Initiative, Abhinav Bansa
Trust: 0.3
sources:
            
            
            BID: 91824

SOURCES
db:VULHUBid:VHN-93464
db:VULMONid:CVE-2016-4645
db:BIDid:91824
db:JVNDBid:JVNDB-2016-004018
db:CNNVDid:CNNVD-201607-894
db:NVDid:CVE-2016-4645

LAST UPDATE DATE
2025-04-13T22:41:25.221000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-93464date:2017-09-01T00:00:00
db:VULMONid:CVE-2016-4645date:2017-09-01T00:00:00
db:BIDid:91824date:2016-08-29T19:00:00
db:JVNDBid:JVNDB-2016-004018date:2016-07-28T00:00:00
db:CNNVDid:CNNVD-201607-894date:2016-07-26T00:00:00
db:NVDid:CVE-2016-4645date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:VULHUBid:VHN-93464date:2016-07-22T00:00:00
db:VULMONid:CVE-2016-4645date:2016-07-22T00:00:00
db:BIDid:91824date:2016-07-18T00:00:00
db:JVNDBid:JVNDB-2016-004018date:2016-07-28T00:00:00
db:CNNVDid:CNNVD-201607-894date:2016-07-26T00:00:00
db:NVDid:CVE-2016-4645date:2016-07-22T03:00:03.387