MobileStorageMounter in Apple iOS before 8.2 and Apple TV before 7.1 does not delete invalid disk-image folders, which allows attackers to create folders in arbitrary filesystem locations via a crafted app.

According to its banner, the remote Apple TV device is missing a security update.  It is, therefore, affected by the following vulnerabilities :

 - There is a flaw in the way that the IOSurface component handles "type confusion" which would allow a remote attacker to execute arbitrary code as a privileged user. (CVE-2015-1061)
 - The MobileStorageMounter component allows attackers to create arbitrary filesystem locations. (CVE-2015-1062)
 - The Secure Transport component allows remote attackers to downgrade the encryption cipher. (CVE-2015-1067)

According to its banner, the remote Apple iOS device is missing a security update.  It is, therefore, affected by the following vulnerabilities :

 - There is a flaw in the way that the IOSurface component handles "type confusion" which would allow a remote attacker to execute arbitrary code as a privileged user. (CVE-2015-1061)
 - There is a flaw in iCloud Keychain which would allow a man-in-the-middle attacker to execute arbitrary code. (CVE-2015-1065)
 - The Springboard component allows a physical attacker to bypass controls and access the home screen.  (CVE-2015-1064)
 - The MobileStorageMounter component allows attackers to create arbitrary filesystem locations. (CVE-2015-1062)
 - The CoreTelephony component allows remote attackers to cause a denial of service. (CVE-2015-1063)
 - The Secure Transport component allows remote attackers to downgrade the encryption cipher. (CVE-2015-1067)

According to its banner, the remote Apple TV device is a version prior to 7.1. It is, therefore, affected by the following vulnerabilities :

  - A type confusion error exists related to 'IOSurface' and     serialized object handling that allow arbitrary code     execution. (CVE-2015-1061)

  - An error exists in 'MobileStorageMounter' related to     developer disk mounting logic and invalid disk image     folders that allows a malicious application to create     folders in trusted locations. (CVE-2015-1062)

  - A security feature bypass vulnerability, known as FREAK     (Factoring attack on RSA-EXPORT Keys), exists due to the     support of weak EXPORT_RSA cipher suites with keys less     than or equal to 512 bits. A man-in-the-middle attacker     may be able to downgrade the SSL/TLS connection to use     EXPORT_RSA cipher suites which can be factored in a     short amount of time, allowing the attacker to intercept     and decrypt the traffic. (CVE-2015-1067)

The mobile device is running a version of iOS prior to version 8.2.
It is, therefore, affected by vulnerabilities in the following components :

  - CoreTelephony
  - iCloud Keychain
  - IOSurface
  - MobileStorageMounter
  - Secure Transport
  - Springboard

ID	Name	Product	Family	Type	Severity
8674	Apple TV < 7.0.4 Multiple Vulnerabilities	Nessus Network Monitor	Internet Services		high
8673	Apple iOS < 8.1.4 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices		high
81790	Apple TV < 7.1 Multiple Vulnerabilities (FREAK)	Nessus	Misc.	Remote	critical
81746	Apple iOS < 8.2 Multiple Vulnerabilities	Nessus	Mobile Devices	Local	high

Detections

Analytics

CVE-2015-1062

medium

Tenable Plugins

high

high

critical

high