ID

VAR-201609-0245

CVE

CVE-2016-4747

TITLE

Apple iOS Vulnerability in obtaining email credentials in email

DESCRIPTION

Mail in Apple iOS before 10 mishandles certificates, which makes it easier for man-in-the-middle attackers to discover mail credentials via unspecified vectors. Apple iOS is prone to multiple security vulnerabilities. Attackers can exploit these issues to bypass security restrictions and perform unauthorized actions or obtain sensitive information. Versions prior to iOS 10 are vulnerable. Apple iOS is an operating system developed by Apple (Apple) for mobile devices. Mail is one of the mail clients. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-09-13-1 iOS 10 iOS 10 is now available and addresses the following: Assets Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An attacker in a privileged network position may be able to block a device from receiving software updates Description: An issue existed in iOS updates, which did not properly secure user communications. This issue was addressed by using HTTPS for software updates. CVE-2016-4741 : Raul Siles of DinoSec GeoServices Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to read sensitive location information Description: A permissions issue existed in PlaceData. This issue was addressed through improved permission validation. CVE-2016-4719 : Razvan Deaconescu, Mihai Chiroiu (University POLITEHNICA of Bucharest); Luke Deshotels, William Enck (North Carolina State University); Lucas Vincenzo Davi, Ahmad-Reza Sadeghi (TU Darmstadt) Keyboards Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Keyboard auto correct suggestions may reveal sensitive information Description: The iOS keyboard was inadvertently caching sensitive information. This issue was addressed through improved heuristics. CVE-2016-4746 : Antoine M of France Mail Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An attacker with a privileged network position may be able to intercept mail credentials Description: An issue existed when handling untrusted certificates. This was addressed by terminating untrusted connections. CVE-2016-4747 : Dave Aitel Messages Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Messages may be visible on a device that has not signed in to Messages Description: An issue existed when using Handoff for Messages. This issue was resolved via better state management. CVE-2016-4740 : Step Wallace Printing UIKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An unencrypted document may be written to a temporary file when using AirPrint preview Description: An issue existed in AirPrint preview. This was addressed through improved environment sanitization. CVE-2016-4749 : an anonymous researcher Sandbox Profiles Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A malicious application may be able to determine whom a user is texting Description: An access control issue existed in SMS draft directories. This issue was addressed by preventing apps from stat'ing the affected directories. CVE-2016-4620 : Razvan Deaconescu, Mihai Chiroiu (University POLITEHNICA of Bucharest); Luke Deshotels, William Enck (North Carolina State University); Lucas Vincenzo Davi, Ahmad-Reza Sadeghi (TU Darmstadt) Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "10". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJX2FJ5AAoJEIOj74w0bLRGa6sQAMPluedIChXWvW/EaZwX/EQ1 cWc7AmcLoWQskymTmN3pzy/WPARDaBFPrMlkGK3KvpB8bvPSFcp+1QI6vUFwLhyV s3Rj5qlqQmEKlyC53BjxrdcbnHGOFzsApEZ43+awZQnDVOnGPQP+NAgq8HUDxy/g 8BK2kdmj++8bEA6MgwaeMNxjzEDXMALxdFBVD3kPUH2na1Y3aji8LQoaDc0OzsqJ nNYmuFbJAAsDAhpuN5fQYhCZhXbiNnQ0b+4X9tALwDAAIxU4nDRlCk8wc+S3MkVZ L78dW+0H0wV1kLyUmjK+sbRjPa56MCd35C3xylDJFVfvWzxjISmGvZvGyXNphQ67 ibbo9NUZArLAGQrXOlY31W5JGegnV2ex6GUmEELsTlPLv3FL5a4sgKVvYY0d9wYz Awa6GG1IjyeWA776ati/gUQYyfnaNn81ccvOdzm97IKETMn5KX15xdgUN6Amqu5H J2q56H4zM6HRIqOUOOWHMoVFMmfeH27c8pbgAi2BIrQOw2jlCoxolwuhfkperoN3 iaUpWIhmmqLxyFpYBwNkEs0/rbVo68fCGQ6eHWPdwr8AVs8aYecUtT8yFFEIpZFy FajGgKdBKrxoXuzNJpBRT3LvZ6tmbEq9u7Lo4DVNNjA5AIgejpyHk3f6OX951a5z SRLzhSdcnaoOnuDWwk/v =Mouo -----END PGP SIGNATURE-----

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote or local

TYPE

information disclosure

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Razvan Deaconescu, Mihai Chiroiu (University POLITEHNICA of Bucharest); Luke Deshotels, Step Wa, Ahmad-Reza Sadeghi (TU Darmstadt),Raul Siles of DinoSec, Dave Aitel, Antoine M of France, William Enck (North Carolina State University); Lucas Vincenzo Davi, Step Wal

SOURCES

LAST UPDATE DATE

2025-04-13T20:28:31.191000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE