Sign-up

ID

VAR-201702-0465


CVE

CVE-2016-7584


TITLE

plural Apple Product AppleMobileFileIntegrity Component forged code forgery vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2016-007480

DESCRIPTION

An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the "AppleMobileFileIntegrity" component, which allows remote attackers to spoof signed code by using a matching team ID. Apple macOS is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass security restrictions and perform unauthorized actions. This may aid in further attacks. Apple macOS Sierra is a dedicated operating system developed by Apple for Mac computers. AppleMobileFileIntegrity (AMFI) is one of the kernel components used to check the integrity of Apple mobile phone files. The vulnerability stems from the program's failure to verify code signatures. An attacker could exploit this vulnerability to execute arbitrary code. The following products and versions are affected: Apple iOS prior to 10.1; macOS Sierra prior to 10.12.1; tvOS prior to 10.0.1; watchOS prior to 3.1

Trust: 1.98

sources: NVD: CVE-2016-7584 // JVNDB: JVNDB-2016-007480 // BID: 94571 // VULHUB: VHN-96404

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:lteversion:10.12.0

Trust: 1.0

vendor:applemodel:iphone osscope:lteversion:10.0.3

Trust: 1.0

vendor:applemodel:tvosscope:lteversion:10.0

Trust: 1.0

vendor:applemodel:watchosscope:lteversion:2.2.2

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.12

Trust: 0.8

vendor:applemodel:iosscope:ltversion:10.1 (ipad first 4 after generation )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:10.1 (iphone 5 or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:10.1 (ipod touch first 6 after generation )

Trust: 0.8

vendor:applemodel:tvosscope:ltversion:10.0.1 (apple tv first 4 generation )

Trust: 0.8

vendor:applemodel:watchosscope:ltversion:3.1 (apple watch all models )

Trust: 0.8

vendor:applemodel:iphone osscope:eqversion:10.0.3

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.12.0

Trust: 0.6

vendor:applemodel:tvscope:eqversion:10.0.0

Trust: 0.6

vendor:applemodel:watch osscope:eqversion:3.0.0

Trust: 0.6

vendor:applemodel:watchosscope:eqversion:2.2.2

Trust: 0.6

vendor:applemodel:macosscope:eqversion:10.12

Trust: 0.3

vendor:applemodel:macosscope:neversion:10.12.1

Trust: 0.3

vendor:applemodel:mac os security updatescope:neversion:x2016-0060

Trust: 0.3

vendor:applemodel:mac os security updatescope:neversion:x2016-0020

Trust: 0.3

sources: BID: 94571 // JVNDB: JVNDB-2016-007480 // CNNVD: CNNVD-201611-673 // NVD: CVE-2016-7584

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-7584
value: HIGH

Trust: 1.0

NVD: CVE-2016-7584
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201611-673
value: HIGH

Trust: 0.6

VULHUB: VHN-96404
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2016-7584
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-96404
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-7584
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-96404 // JVNDB: JVNDB-2016-007480 // CNNVD: CNNVD-201611-673 // NVD: CVE-2016-7584

PROBLEMTYPE DATA

problemtype:CWE-254

Trust: 1.9

sources: VULHUB: VHN-96404 // JVNDB: JVNDB-2016-007480 // NVD: CVE-2016-7584

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201611-673

TYPE

security feature problem

Trust: 0.6

sources: CNNVD: CNNVD-201611-673

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-007480

PATCH
title:Apple security updatesurl:https://support.apple.com/en-us/HT201222
Trust: 0.8
title:APPLE-SA-2016-10-24-2 macOS Sierra 10.12.1url:https://lists.apple.com/archives/security-announce/2016/Oct/msg00001.html
Trust: 0.8
title:APPLE-SA-2016-10-24-4 tvOS 10.0.1url:https://lists.apple.com/archives/security-announce/2016/Oct/msg00003.html
Trust: 0.8
title:APPLE-SA-2016-10-24-5 watchOS 3.1url:https://lists.apple.com/archives/security-announce/2016/Oct/msg00004.html
Trust: 0.8
title:APPLE-SA-2016-10-24-1 iOS 10.1url:https://lists.apple.com/archives/security-announce/2016/Oct/msg00000.html
Trust: 0.8
title:HT207270url:https://support.apple.com/en-us/HT207270
Trust: 0.8
title:HT207271url:https://support.apple.com/en-us/HT207271
Trust: 0.8
title:HT207275url:https://support.apple.com/en-us/HT207275
Trust: 0.8
title:HT207269url:https://support.apple.com/en-us/HT207269
Trust: 0.8
title:HT207269url:https://support.apple.com/ja-jp/HT207269
Trust: 0.8
title:HT207270url:https://support.apple.com/ja-jp/HT207270
Trust: 0.8
title:HT207271url:https://support.apple.com/ja-jp/HT207271
Trust: 0.8
title:HT207275url:https://support.apple.com/ja-jp/HT207275
Trust: 0.8
title:Apple macOS Repair measures for security bypass vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=65944
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2016-007480 // 
            
            
            
            CNNVD: CNNVD-201611-673

EXTERNAL IDS
db:NVDid:CVE-2016-7584
Trust: 2.8
db:BIDid:94571
Trust: 2.0
db:JVNid:JVNVU90743185
Trust: 0.8
db:JVNDBid:JVNDB-2016-007480
Trust: 0.8
db:CNNVDid:CNNVD-201611-673
Trust: 0.7
db:VULHUBid:VHN-96404
Trust: 0.1
sources:
            
            
            VULHUB: VHN-96404 // 
            
            
            
            BID: 94571 // 
            
            
            
            JVNDB: JVNDB-2016-007480 // 
            
            
            
            CNNVD: CNNVD-201611-673 // 
            
            
            
            NVD: CVE-2016-7584

REFERENCES
url:http://www.securityfocus.com/bid/94571
Trust: 1.7
url:https://support.apple.com/ht207269
Trust: 1.7
url:https://support.apple.com/ht207270
Trust: 1.7
url:https://support.apple.com/ht207271
Trust: 1.7
url:https://support.apple.com/ht207275
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-7584
Trust: 0.8
url:http://jvn.jp/vu/jvnvu90743185/index.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-7584
Trust: 0.8
url:https://support.apple.com/en-in/ht207275
Trust: 0.3
url:https://www.apple.com/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-96404 // 
            
            
            
            BID: 94571 // 
            
            
            
            JVNDB: JVNDB-2016-007480 // 
            
            
            
            CNNVD: CNNVD-201611-673 // 
            
            
            
            NVD: CVE-2016-7584

CREDITS
Mark Mentovai and Boris Vidolov of Google Inc.
Trust: 0.9
sources:
            
            
            BID: 94571 // 
            
            
            
            CNNVD: CNNVD-201611-673

SOURCES
db:VULHUBid:VHN-96404
db:BIDid:94571
db:JVNDBid:JVNDB-2016-007480
db:CNNVDid:CNNVD-201611-673
db:NVDid:CVE-2016-7584

LAST UPDATE DATE
2025-04-20T20:54:02.615000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-96404date:2019-03-08T00:00:00
db:BIDid:94571date:2016-12-20T02:03:00
db:JVNDBid:JVNDB-2016-007480date:2017-03-01T00:00:00
db:CNNVDid:CNNVD-201611-673date:2019-03-13T00:00:00
db:NVDid:CVE-2016-7584date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:VULHUBid:VHN-96404date:2017-02-20T00:00:00
db:BIDid:94571date:2016-11-27T00:00:00
db:JVNDBid:JVNDB-2016-007480date:2017-03-01T00:00:00
db:CNNVDid:CNNVD-201611-673date:2016-11-27T00:00:00
db:NVDid:CVE-2016-7584date:2017-02-20T08:59:01.637