ID

VAR-201707-1165


CVE

CVE-2017-7063


TITLE

Apple iOS and watchOS of Messages Service disruption in components (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2017-005735

DESCRIPTION

An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. watchOS before 3.2.3 is affected. The issue involves the "Messages" component. It allows remote attackers to cause a denial of service (memory consumption and application crash). Apple iOS/watchOS are prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause a denial-of-service condition, denying service to legitimate users. Versions prior to iOS 10.3.3 and watchOS 3.2.3 are vulnerable. Apple iOS is an operating system developed for mobile devices; Apple watchOS is an operating system for smart watches. Messages is one of the application components for sending texts, photos and videos. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2017-07-19-3 watchOS 3.2.2 watchOS 3.2.2 is now available and addresses the following: Contacts Available for: All Apple Watch models Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: A buffer overflow issue was addressed through improved memory handling. CVE-2017-7062: Shashank (@cyberboyIndia) IOUSBFamily Available for: All Apple Watch models Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-7009: shrek_wzw of Qihoo 360 Nirvan Team Kernel Available for: All Apple Watch models Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-7022: an anonymous researcher CVE-2017-7024: an anonymous researcher CVE-2017-7026: an anonymous researcher Kernel Available for: All Apple Watch models Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-7023: an anonymous researcher CVE-2017-7025: an anonymous researcher CVE-2017-7027: an anonymous researcher CVE-2017-7069: Proteas of Qihoo 360 Nirvan Team Kernel Available for: All Apple Watch models Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2017-7028: an anonymous researcher CVE-2017-7029: an anonymous researcher libarchive Available for: All Apple Watch models Impact: Unpacking a maliciously crafted archive may lead to arbitrary code execution Description: A buffer overflow was addressed through improved bounds checking. CVE-2017-7068: found by OSS-Fuzz libxml2 Available for: All Apple Watch models Impact: Parsing a maliciously crafted XML document may lead to disclosure of user information Description: An out-of-bounds read was addressed through improved bounds checking. CVE-2017-7013: found by OSS-Fuzz libxpc Available for: All Apple Watch models Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-7047: Ian Beer of Google Project Zero Messages Available for: All Apple Watch models Impact: A remote attacker may cause an unexpected application termination Description: A memory consumption issue was addressed through improved memory handling. CVE-2017-7063: Shashank (@cyberboyIndia) Wi-Fi Available for: All Apple Watch models Impact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-9417: Nitay Artenstein of Exodus Intelligence Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJZb5VSAAoJEIOj74w0bLRGds4P/jn6yqMh+cw1dYmhfloU/XGi J4Q6JbGTWLBvacsucsneTvDW6EtuZUWTENaRsndj3HFK+awwEcdfx/MkEO7LaDfQ 0cVBkij5+V0hEn3e6eNItTdKZ85h5C4zjEE76BPw6hqcCuf9t3ZqDtyubKKXb3V+ 6D6l64G/m5krs/bB65Evj/XSd3d1vNLQ03zYCKjfgqpI5P/pFv2PEdzOnH8oWYz8 mVcqQW6sRgiFsIq4W88qP1WaQmDLVlYdoPqfd+a98JoGDUebi6PcgxxJl9fXFIo6 jv0zBoXr2begOJFSo3duxOPxlnLienv+qNScdENTDgZORcJ8loALtnCN5ICWIGcE K1eqNW63nNK0Gq1EhMXMT3MktgbP8BJEc8pEs82U73XD9DVgYKcCGGNzfj7qFQAm GE18IEd20h+0N/Irk+TN+9pYf+Vf+7RNA4naRfLBOsiTRZjmDJ3ds9LWawle5Rlx hR9mznsR3zqhh6vBDvIt9vSEJXV5X61hkTe7Q4jHkHj04XLUidMWkI47BqLGYTK6 jtEHF/4Mk5A+KG+jjpxZs6LtweTQqudQSqnDXtJlE1LRJ4b1jHNNUUm05tx2lGxi zrDgNGFQtzZ0Gds9wXQjpE5eFNa7X2VUArqHiJUHnoxLMvLtBVMa7vuTvyrPGdnb QvBYRDybEp8yUkxd8seM =Ci3F -----END PGP SIGNATURE-----

Trust: 2.07

sources: NVD: CVE-2017-7063 // JVNDB: JVNDB-2017-005735 // BID: 99881 // VULHUB: VHN-115266 // PACKETSTORM: 143433

AFFECTED PRODUCTS

vendor:applemodel:iphone osscope:lteversion:10.3.2

Trust: 1.0

vendor:applemodel:watchosscope:lteversion:3.2.2

Trust: 1.0

vendor:applemodel:watchosscope:eqversion:3.2.2

Trust: 0.9

vendor:applemodel:iosscope:ltversion:10.3.3 (ipad first 4 after generation )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:10.3.3 (iphone 5 or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:10.3.3 (ipod touch first 6 generation )

Trust: 0.8

vendor:applemodel:watchosscope:ltversion:3.2.3 (apple watch all models )

Trust: 0.8

vendor:applemodel:iphone osscope:eqversion:10.3.2

Trust: 0.6

vendor:applemodel:watchosscope:eqversion:10.1.1

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:3.1.3

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:3.1.1

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:2.2.2

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:2.2.1

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:2.0.1

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:1.0.1

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:3.2.1

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:3.2

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:3.1

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:3.0

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:3

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:2.2

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:2.1

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:2.0

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:1.0

Trust: 0.3

vendor:applemodel:watch sportscope:eqversion:0

Trust: 0.3

vendor:applemodel:watch hermesscope:eqversion:0

Trust: 0.3

vendor:applemodel:watch editionscope:eqversion:0

Trust: 0.3

vendor:applemodel:watchscope:eqversion:0

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:0

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:0

Trust: 0.3

vendor:applemodel:ipadscope:eqversion:0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:50

Trust: 0.3

vendor:applemodel:iosscope:eqversion:40

Trust: 0.3

vendor:applemodel:iosscope:eqversion:30

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.4.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.9

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.10

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10

Trust: 0.3

vendor:applemodel:watchosscope:neversion:3.2.3

Trust: 0.3

vendor:applemodel:iosscope:neversion:10.3.3

Trust: 0.3

sources: BID: 99881 // JVNDB: JVNDB-2017-005735 // CNNVD: CNNVD-201707-948 // NVD: CVE-2017-7063

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-7063
value: HIGH

Trust: 1.0

NVD: CVE-2017-7063
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201707-948
value: HIGH

Trust: 0.6

VULHUB: VHN-115266
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-7063
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-115266
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-7063
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-115266 // JVNDB: JVNDB-2017-005735 // CNNVD: CNNVD-201707-948 // NVD: CVE-2017-7063

PROBLEMTYPE DATA

problemtype:CWE-400

Trust: 1.1

problemtype:CWE-399

Trust: 0.9

sources: VULHUB: VHN-115266 // JVNDB: JVNDB-2017-005735 // NVD: CVE-2017-7063

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201707-948

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201707-948

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-005735

PATCH

title:Apple security updatesurl:https://support.apple.com/en-us/HT201222

Trust: 0.8

title:HT207923url:https://support.apple.com/en-us/HT207923

Trust: 0.8

title:HT207925url:https://support.apple.com/en-us/HT207925

Trust: 0.8

title:HT207923url:https://support.apple.com/ja-jp/HT207923

Trust: 0.8

title:HT207925url:https://support.apple.com/ja-jp/HT207925

Trust: 0.8

title:Apple iOS and watchOS Messages Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=71890

Trust: 0.6

sources: JVNDB: JVNDB-2017-005735 // CNNVD: CNNVD-201707-948

EXTERNAL IDS

db:NVDid:CVE-2017-7063

Trust: 2.9

db:BIDid:99881

Trust: 2.0

db:SECTRACKid:1038950

Trust: 1.7

db:JVNid:JVNVU91410779

Trust: 0.8

db:JVNDBid:JVNDB-2017-005735

Trust: 0.8

db:CNNVDid:CNNVD-201707-948

Trust: 0.7

db:VULHUBid:VHN-115266

Trust: 0.1

db:PACKETSTORMid:143433

Trust: 0.1

sources: VULHUB: VHN-115266 // BID: 99881 // JVNDB: JVNDB-2017-005735 // PACKETSTORM: 143433 // CNNVD: CNNVD-201707-948 // NVD: CVE-2017-7063

REFERENCES

url:http://www.securityfocus.com/bid/99881

Trust: 1.7

url:https://support.apple.com/ht207923

Trust: 1.7

url:https://support.apple.com/ht207925

Trust: 1.7

url:http://www.securitytracker.com/id/1038950

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2017-7063

Trust: 0.9

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-7063

Trust: 0.8

url:http://jvn.jp/vu/jvnvu91410779/index.html

Trust: 0.8

url:http://www.apple.com/ios/

Trust: 0.3

url:http://www.apple.com/watchos-2/

Trust: 0.3

url:https://support.apple.com/en-us/ht207923

Trust: 0.3

url:https://support.apple.com/en-us/ht207925

Trust: 0.3

url:https://support.apple.com/kb/ht204641

Trust: 0.1

url:https://support.apple.com/kb/ht201222

Trust: 0.1

url:https://gpgtools.org

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2017-7009

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2017-7028

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2017-7068

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2017-7029

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2017-7024

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2017-7062

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2017-7022

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2017-9417

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2017-7069

Trust: 0.1

url:https://www.apple.com/support/security/pgp/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2017-7047

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2017-7026

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2017-7023

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2017-7027

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2017-7013

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2017-7025

Trust: 0.1

sources: VULHUB: VHN-115266 // BID: 99881 // JVNDB: JVNDB-2017-005735 // PACKETSTORM: 143433 // CNNVD: CNNVD-201707-948 // NVD: CVE-2017-7063

CREDITS

Shashank (@cyberboyIndia)

Trust: 0.3

sources: BID: 99881

SOURCES

db:VULHUBid:VHN-115266
db:BIDid:99881
db:JVNDBid:JVNDB-2017-005735
db:PACKETSTORMid:143433
db:CNNVDid:CNNVD-201707-948
db:NVDid:CVE-2017-7063

LAST UPDATE DATE

2025-04-20T22:27:12.701000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-115266date:2019-10-03T00:00:00
db:BIDid:99881date:2017-07-19T00:00:00
db:JVNDBid:JVNDB-2017-005735date:2017-08-04T00:00:00
db:CNNVDid:CNNVD-201707-948date:2019-10-23T00:00:00
db:NVDid:CVE-2017-7063date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:VULHUBid:VHN-115266date:2017-07-20T00:00:00
db:BIDid:99881date:2017-07-19T00:00:00
db:JVNDBid:JVNDB-2017-005735date:2017-08-04T00:00:00
db:PACKETSTORMid:143433date:2017-07-20T15:22:22
db:CNNVDid:CNNVD-201707-948date:2017-07-24T00:00:00
db:NVDid:CVE-2017-7063date:2017-07-20T16:29:02.427