Sign-up

ID

VAR-201702-0336


CVE

CVE-2016-4678


TITLE

Apple OS X of AppleSMC Vulnerability gained privileges in components

Trust: 0.8

sources: JVNDB: JVNDB-2016-007367

DESCRIPTION

An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "AppleSMC" component. It allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors. This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Apple OS X. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within AppleSMC's smcHandleYPCEvent. The process does not properly validate the existence of an object prior to performing operations on it. An attacker can leverage this vulnerability to escalate privileges under the context of the kernel. Apple macOS is prone to multiple security vulnerabilities. Attackers can exploit these issues to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, gain elevated privileges and perform unauthorized actions. This may aid in other attacks. AppleSMC is one of the components used to reset the System Management Controller on a Mac. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-10-24-2 macOS Sierra 10.12.1 macOS Sierra 10.12.1 is now available and addresses the following: AppleGraphicsControl Available for: OS X Yosemite v10.10.5 and OS X El Capitan v10.11.6 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved lock state checking. CVE-2016-4678: daybreaker@Minionz working with Trend Micro's Zero Day Initiative ATS Available for: macOS Sierra 10.12 Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved memory handling. CVE-2016-4667: Simmon Huang of alipay, Thelongestusernameofall@gmail.com Moony Li of Trend Micro, @Flyic ATS Available for: macOS Sierra 10.12 Impact: A local user may be able to execute arbitrary code with additional privileges Description: A memory corruption issue was addressed through improved memory handling. CVE-2016-4674: Shrek_wzw of Qihoo 360 Nirvan Team CFNetwork Proxies Available for: macOS Sierra 10.12 Impact: An attacker in a privileged network position may be able to leak sensitive user information Description: A phishing issue existed in the handling of proxy credentials. This issue was addressed by removing unsolicited proxy password authentication prompts. CVE-2016-7579: Jerry Decime CoreGraphics Available for: macOS Sierra 10.12 Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved memory handling. CVE-2016-4673: Marco Grassi (@marcograss) of KeenLab (@keen_lab), Tencent FaceTime Available for: macOS Sierra 10.12 Impact: An attacker in a privileged network position may be able to cause a relayed call to continue transmitting audio while appearing as if the call terminated Description: User interface inconsistencies existed in the handling of relayed calls. These issues were addressed through improved FaceTime display logic. CVE-2016-4635: Martin Vigo (@martin_vigo) of salesforce.com FontParser Available for: macOS Sierra 10.12 Impact: Parsing a maliciously crafted font may disclose sensitive user information Description: An out-of-bounds read was addressed through improved bounds checking. CVE-2016-4660: Ke Liu of Tencent's Xuanwu Lab ImageIO Available for: OS X El Capitan v10.11.6 Impact: Parsing a maliciously crafted PDF may lead to arbitrary code execution Description: An out-of-bounds write was addressed through improved bounds checking. CVE-2016-4671: Ke Liu of Tencent's Xuanwu Lab, Juwei Lin (@fuzzerDOTcn) ImageIO Available for: OS X Yosemite v10.10.5 and OS X El Capitan v10.11.6 Impact: Processing a maliciously crafted image may result in the disclosure of process memory Description: An out-of-bounds read issue existed in the SGI image parsing. This issue was addressed through improved bounds checking. CVE-2016-4682: Ke Liu of Tencent's Xuanwu Lab libarchive Available for: macOS Sierra 10.12 Impact: A malicious archive may be able to overwrite arbitrary files Description: An issue existed within the path validation logic for symlinks. This issue was addressed through improved path sanitization. CVE-2016-4679: Omer Medan of enSilo Ltd libxpc Available for: OS X Yosemite 10.10.5, OS X El Capitan 10.11.6, and macOS Sierra 10.12 Impact: An application may be able to execute arbitrary code with root privileges Description: A logic issue was addressed through additional restrictions. CVE-2016-4675: Ian Beer of Google Project Zero ntfs Available for: macOS Sierra 10.12 Impact: An application may be able to cause a denial of service Description: An issue existed in the parsing of disk images. This issue was addressed through improved validation. CVE-2016-4661: Recurity Labs on behalf of BSI (German Federal Office for Information Security) NVIDIA Graphics Drivers Available for: OS X Yosemite v10.10.5 and OS X El Capitan v10.11.6 Impact: An application may be able to cause a denial of service Description: A memory corruption issue was addressed through improved input validation. CVE-2016-4663: Apple System Boot Available for: OS X Yosemite 10.10.5, OS X El Capitan 10.11.6, and macOS Sierra 10.12 Impact: A local user may be able to cause an unexpected system termination or arbitrary code execution in the kernel Description: Multiple input validation issues existed in MIG generated code. These issues were addressed through improved validation. CVE-2016-4669: Ian Beer of Google Project Zero macOS Sierra 10.12.1 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://www.apple.com/support/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJYDlRWAAoJEIOj74w0bLRGFnYP/iy1NY+HgMgJd4OeOakX4sGP 8utQ55plu7WdQ3imNdcP1NYm+tuqFLxSDm7qJMA4zsAakxdUAGWEWYjRmJ9IxTep Gil1qjXZHksX/7lF+VzoMcsAC4CE0yFnaFAw0gHdhQFZyzYryPVsryue56WX5DAD 4/MJUK85U1P2YRDkMW8Mt4TrOW0kgpohpZIFsWKmBocZ4Q/GLybQLzip7mv9w4/K k8L+m9oHUr+Bh7Et+OoM+4oTBC2pIwdb9U5edTHqIMpXp15jScTXbQ/pz+ngjZ6E wUDa8hZC30m6SWSJtFUMZ5+6Gedcafcn/kegRPeFwitQ13EnLOVeGekp25ROsnF1 NwXiDDYuUxTg8ecW6YJm1OktO035nUg3Rjnonx3km2FNDiFgakK78p622B/eJwOA WbD6ahu8qAFTf14pCe7WJVvQz4vnjwiwTQxOTxVgiLfAdFHNm9IpxazwEeW8sN+G cjvoi5VTWL8FiHfUITnJrzeclitgke67vhOs6Ju5+nYiKrUf74NoNnFBPMjD4Qa1 GfvjZ2LWUVBLBahWUl2Nhlr4EWECqF3AEZhBRmcvcHnspcN3f9BBD/kktvpqTAV9 J5TqpiRr2qhrQEV8WLt/GvZSf7hjnSMPUZS4pi27ZKSugkTQsHJs4eWE6awQUgrV E0naX6k6U0S+vJiI0JU7 =eHH+ -----END PGP SIGNATURE-----

Trust: 2.7

sources: NVD: CVE-2016-4678 // JVNDB: JVNDB-2016-007367 // ZDI: ZDI-16-589 // BID: 93852 // VULHUB: VHN-93497 // PACKETSTORM: 139320

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:lteversion:10.12.0

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.12

Trust: 0.8

vendor:applemodel:os xscope: - version: -

Trust: 0.7

vendor:applemodel:mac os xscope:eqversion:10.12.0

Trust: 0.6

vendor:applemodel:macosscope:eqversion:10.12

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.11.6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.11.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.11.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.11.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.10.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.11.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.11.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.11

Trust: 0.3

vendor:applemodel:macosscope:neversion:10.12.1

Trust: 0.3

sources: ZDI: ZDI-16-589 // BID: 93852 // JVNDB: JVNDB-2016-007367 // CNNVD: CNNVD-201610-709 // NVD: CVE-2016-4678

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-4678
value: HIGH

Trust: 1.0

NVD: CVE-2016-4678
value: HIGH

Trust: 0.8

ZDI: CVE-2016-4678
value: MEDIUM

Trust: 0.7

CNNVD: CNNVD-201610-709
value: MEDIUM

Trust: 0.6

VULHUB: VHN-93497
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2016-4678
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

ZDI: CVE-2016-4678
severity: MEDIUM
baseScore: 6.9
vectorString: AV:L/AC:M/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.4
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

VULHUB: VHN-93497
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-4678
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: ZDI: ZDI-16-589 // VULHUB: VHN-93497 // JVNDB: JVNDB-2016-007367 // CNNVD: CNNVD-201610-709 // NVD: CVE-2016-4678

PROBLEMTYPE DATA

problemtype:CWE-476

Trust: 1.9

sources: VULHUB: VHN-93497 // JVNDB: JVNDB-2016-007367 // NVD: CVE-2016-4678

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201610-709

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201610-709

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-007367

PATCH
title:Apple security updatesurl:https://support.apple.com/en-us/HT201222
Trust: 1.5
title:APPLE-SA-2016-10-24-2 macOS Sierra 10.12.1url:https://lists.apple.com/archives/security-announce/2016/Oct/msg00001.html
Trust: 0.8
title:HT207275url:https://support.apple.com/en-us/HT207275
Trust: 0.8
title:HT207275url:https://support.apple.com/ja-jp/HT207275
Trust: 0.8
title:Apple macOS Sierra AppleSMC Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=65072
Trust: 0.6
sources:
            
            
            ZDI: ZDI-16-589 // 
            
            
            
            JVNDB: JVNDB-2016-007367 // 
            
            
            
            CNNVD: CNNVD-201610-709

EXTERNAL IDS
db:NVDid:CVE-2016-4678
Trust: 3.6
db:BIDid:93852
Trust: 2.0
db:SECTRACKid:1037086
Trust: 1.1
db:ZDIid:ZDI-16-589
Trust: 1.0
db:JVNid:JVNVU90743185
Trust: 0.8
db:JVNDBid:JVNDB-2016-007367
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-3908
Trust: 0.7
db:CNNVDid:CNNVD-201610-709
Trust: 0.7
db:VULHUBid:VHN-93497
Trust: 0.1
db:PACKETSTORMid:139320
Trust: 0.1
sources:
            
            
            ZDI: ZDI-16-589 // 
            
            
            
            VULHUB: VHN-93497 // 
            
            
            
            BID: 93852 // 
            
            
            
            JVNDB: JVNDB-2016-007367 // 
            
            
            
            PACKETSTORM: 139320 // 
            
            
            
            CNNVD: CNNVD-201610-709 // 
            
            
            
            NVD: CVE-2016-4678

REFERENCES
url:http://www.securityfocus.com/bid/93852
Trust: 1.7
url:https://support.apple.com/ht207275
Trust: 1.7
url:http://www.securitytracker.com/id/1037086
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-4678
Trust: 0.8
url:http://jvn.jp/vu/jvnvu90743185/index.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-4678
Trust: 0.8
url:https://support.apple.com/en-us/ht201222
Trust: 0.7
url:http://www.apple.com/macosx/
Trust: 0.3
url:https://support.apple.com/en-ie/ht207275
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-589/
Trust: 0.3
url:https://support.apple.com/kb/ht201222
Trust: 0.1
url:https://gpgtools.org
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-4675
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-4682
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-4661
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-4678
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-4667
Trust: 0.1
url:https://www.apple.com/support/security/pgp/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-4662
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-4669
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-4660
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-4635
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-4674
Trust: 0.1
url:https://www.apple.com/support/downloads/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-4671
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-4679
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-7579
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-4663
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-4673
Trust: 0.1
sources:
            
            
            ZDI: ZDI-16-589 // 
            
            
            
            VULHUB: VHN-93497 // 
            
            
            
            BID: 93852 // 
            
            
            
            JVNDB: JVNDB-2016-007367 // 
            
            
            
            PACKETSTORM: 139320 // 
            
            
            
            CNNVD: CNNVD-201610-709 // 
            
            
            
            NVD: CVE-2016-4678

CREDITS
daybreaker@Minionz
Trust: 0.7
sources:
            
            
            ZDI: ZDI-16-589

SOURCES
db:ZDIid:ZDI-16-589
db:VULHUBid:VHN-93497
db:BIDid:93852
db:JVNDBid:JVNDB-2016-007367
db:PACKETSTORMid:139320
db:CNNVDid:CNNVD-201610-709
db:NVDid:CVE-2016-4678

LAST UPDATE DATE
2025-04-20T22:58:49.903000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-16-589date:2016-11-02T00:00:00
db:VULHUBid:VHN-93497date:2017-07-29T00:00:00
db:BIDid:93852date:2016-11-24T01:08:00
db:JVNDBid:JVNDB-2016-007367date:2017-02-28T00:00:00
db:CNNVDid:CNNVD-201610-709date:2017-03-13T00:00:00
db:NVDid:CVE-2016-4678date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:ZDIid:ZDI-16-589date:2016-11-02T00:00:00
db:VULHUBid:VHN-93497date:2017-02-20T00:00:00
db:BIDid:93852date:2016-10-24T00:00:00
db:JVNDBid:JVNDB-2016-007367date:2017-02-28T00:00:00
db:PACKETSTORMid:139320date:2016-10-24T21:46:59
db:CNNVDid:CNNVD-201610-709date:2016-10-25T00:00:00
db:NVDid:CVE-2016-4678date:2017-02-20T08:59:00.777