The Sandbox Profiles component in Apple iOS before 10 does not properly restrict access to directory metadata for SMS draft directories, which allows attackers to discover text-message recipients via a crafted app.

The version of iOS running on the mobile device is prior to 10.0, and is affected by multiple vulnerabilities in the following components :

 - AppleMobileFileIntegrity (CVE-2016-4698)
 - Assets (CVE-2016-4741)
 - Audio (CVE-2016-4702)
 - CFNetwork (CVE-2016-4707, CVE-2016-4708)
 - CommonCrypto (CVE-2016-4711, CVE-2016-4712)
 - FontParser (CVE-2016-4718)
 - GeoServices (CVE-2016-4719)
 - IDS - Connectivity (CVE-2016-4722)
 - IOAcceleratorFamily (CVE-2016-4724, CVE-2016-4725, CVE-2016-4726)
 - Kernel (CVE-2016-4771, CVE-2016-4772, CVE-2016-4773, CVE-2016-4774, CVE-2016-4776, CVE-2016-4777, CVE-2016-4778)
 - Keyboards (CVE-2016-4746)
 - libxml2 (CVE-2016-4658, CVE-2016-5131)
 - libxslt (CVE-2016-4738)
 - Mail (CVE-2016-4747)
 - Messages (CVE-2016-4740)
 - Printing UIKit (CVE-2016-4749)
 - S2 Camera (CVE-2016-4750)
 - Safari Reader (CVE-2016-4618)
 - Sandbox Profiles (CVE-2016-4620)
 - Security (CVE-2016-4753)
 - Springboard (CVE-2016-7759)
 - WebKit (CVE-2016-4728, CVE-2016-4758, CVE-2016-4611, CVE-2016-4729, CVE-2016-4730, CVE-2016-4731, CVE-2016-4734, CVE-2016-4735, CVE-2016-4737, CVE-2016-4759, CVE-2016-4762, CVE-2016-4766, CVE-2016-4767, CVE-2016-4768, CVE-2016-4760, CVE-2016-4733, CVE-2016-4765, CVE-2016-4763)

The version of iOS running on the mobile device is prior to 10. It is, therefore, affected by multiple vulnerabilities :

  - An access control issue exists in the Sandbox Profiles     component in SMS draft directories that allows a local     attacker to determine who a user is texting by using the     'stat' command on a directory. (CVE-2016-4620)

  - An unspecified permissions issue exists in PlaceData in     the GeoServices component that allows a local attacker,     via a crafted application, to disclose sensitive     information. (CVE-2016-4719)

  - A flaw exists in the Messages component in the Handoff     for Messages functionality due to incorrectly exposing     messages even while signed out. A physically present     attacker can exploit this to disclose sensitive     information. (CVE-2016-4740)

  - A flaw exists in the Assets component due to updates     being sent over unencrypted channels. A     man-in-the-middle attacker can exploit this to block a     device from receiving software updates. (CVE-2016-4741)

  - A flaw exists in the Keyboards component due to the     Keyboard Autocorrect Suggestion feature inadvertently     caching sensitive information. A physically present     attacker can exploit this to disclose sensitive     information. (CVE-2016-4746)

  - A flaw exists in the Mail component due to improper     handling of untrusted certificates. A man-in-the-middle     attacker can exploit this to disclose credential     information. (CVE-2016-4747)

  - A flaw exists in the Printing UIKit component when     writing an unencrypted document to a temporary file when     using AirPrint preview. A local attacker can exploit     this to disclose sensitive information. (CVE-2016-4749)

  - A flaw exists in the Springboard component due to cached     application snapshots being displayed in the task     switcher. A local attacker can exploit this to disclose     sensitive information. (CVE-2016-7759)

  - A flaw exists related to the BlueTooth subsystem that     could allow remote code execution as well as     man-in-the-middle attacks. This issue is also known as     'BlueBorne'.

ID	Name	Product	Family	Severity
9619	Apple iOS < 10.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical
93515	Apple iOS < 10 Multiple Vulnerabilities (BlueBorne)	Nessus	Mobile Devices	high

Detections

Analytics

CVE-2016-4620

low

Tenable Plugins

critical

high