FaceTime in Apple iOS before 9.3.3 and OS X before 10.11.6 allows man-in-the-middle attackers to spoof relayed-call termination, and obtain sensitive audio information in opportunistic circumstances, via unspecified vectors.

The remote host is running a version of Mac OS X version 10.x prior to 10.12.1, and is affected by multiple vulnerabilities in the following components :

 - AppleMobileFileIntegrity (CVE-2016-7584)
 - AppleGraphicsControl (CVE-2016-4662)
 - AppleSMC (CVE-2016-4678)
 - ATS (CVE-2016-4667, CVE-2016-4674)
 - CFNetwork Proxies (CVE-2016-7579)
 - CoreGraphics (CVE-2016-4673)
 - Core Image (CVE-2016-4681)
 - FaceTime (CVE-2016-7577)
 - FontParser (CVE-2016-4660, CVE-2016-4688)
 - IDS - Connectivity (CVE-2016-4721)
 - ImageIO (CVE-2016-4671, CVE-2016-4682, CVE-2016-4683)
 - Kernel (CVE-2016-4669, CVE-2016-7613)
 - libarchive (CVE-2016-4679)
 - libxpc (CVE-2016-4675)
 - ntfs (CVE-2016-4661)
 - NVIDIA Graphics Drivers (CVE-2016-4663)
 - Security (CVE-2016-4670)
 - Thunderbolt (CVE-2016-4780)

The version of iOS running on the mobile device is prior to 10.1. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the FaceTime component when handling     relayed calls due to inconsistencies in the user     interface. A man-in-the-middle attacker can exploit this     issue to cause a relayed call to continue to transmit     audio while the call appears to be terminated.
    (CVE-2016-4635)

  - An out-of-bounds read error exists in the FontParser     component when handling specially crafted font files     that allows an unauthenticated, remote attacker to     disclose sensitive information. (CVE-2016-4660)

  - An unspecified flaw exists in the Sandbox Profiles     component that allows a local attacker, via a specially     crafted application, to disclose the metadata of photo     directories. (CVE-2016-4664)

  - An unspecified flaw exists in the Sandbox Profiles     component that allows a local attacker, via a specially     crafted application, to disclose the metadata of audio     recordings. (CVE-2016-4665)

  - Multiple memory corruption issues exist in Webkit due     to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these to     execute arbitrary code. (CVE-2016-4666, CVE-2016-4677)

  - Multiple unspecified flaws exist in the System Boot     component, within MIG generated code, due to improper     validation of input. A local attacker can exploit these     to terminate the system or execute arbitrary code with     elevated privileges. (CVE-2016-4669)

  - A flaw exists in the Security component due to the     program logging the length of passwords. A local     attacker can exploit this to disclose sensitive     information. (CVE-2016-4670)

  - A memory corruption issue exists in the CoreGraphics     component when handling specially crafted JPEG files. An     unauthenticated, remote attacker can exploit this, via a     specially crafted file, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-4673)

  - An unspecified logic issue exists in libxpc that allows     a local attacker to execute arbitrary code with root     privileges. (CVE-2016-4675)

  - A flaw exists in libarchive due to improper path     validation when creating temporary files during archive     extraction. An unauthenticated, remote attacker can     exploit this, via a symlink attack, to overwrite     arbitrary files. (CVE-2016-4679)

  - An unspecified flaw exists in the Kernel component due     to improper sanitization of input. A local attacker can     exploit this to disclose kernel memory contents.
    (CVE-2016-4680)

  - A flaw exists in the Contacts component due to a failure     to revoke an application's access to the Address Book     after its access has been removed in Settings. A local     attacker can exploit this to cause access to persist     after it should have been removed. (CVE-2016-4686)

  - A flaw exists in the CFNetworks component when handling     proxy credentials that allows a man-in-the-middle     attacker to disclose sensitive user information.
    (CVE-2016-7579)

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.6, and the following components contain vulnerabilities :

 - ACMP4AACBaseDecoder
 - Audio
 - CFNetwork
 - CoreGraphics
 - DspFuncLib
 - FaceTime
 - Graphics
 - IOHIDFamily
 - IOSurface
 - ImageIO
 - Kernel
 - QuickTime
 - Safari
 - Sandbox
 - libxml2

The remote host is running a version of Mac OS X that is 10.11.x prior to 10.11.6. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - Audio
  - bsdiff
  - CFNetwork
  - CoreGraphics
  - FaceTime
  - Graphics Drivers
  - ImageIO
  - Intel Graphics Driver
  - IOHIDFamily
  - IOKit
  - IOSurface
  - Kernel
  - libc++abi
  - libexpat
  - LibreSSL
  - libxml2
  - libxslt
  - Login Window
  - OpenSSL
  - QuickTime
  - Safari Login AutoFill
  - Sandbox Profiles

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The version of iOS running on the mobile device is prior to 9.3.3. It is, therefore, affected by multiple vulnerabilities, the most serious of which can result in remote code execution, in the following components :

  - Calendar
  - CoreGraphics
  - FaceTime
  - ImageIO
  - IOAcceleratorFamily
  - IOHIDFamily
  - Kernel
  - libxml2
  - libxslt
  - Safari
  - Sandbox Profiles
  - Siri Contacts
  - Web Media
  - WebKit
  - WebKit JavaScript Bindings
  - WebKit Page Loading

ID	Name	Product	Family	Type	Severity
9758	Mac OS X 10.x < 10.12.1 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection		high
94330	Apple iOS < 10.1 Multiple Vulnerabilities	Nessus	Mobile Devices	Local	high
9441	Mac OS X 10.11.x < 10.11.6 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection		critical
92496	Mac OS X 10.11.x < 10.11.6 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Combined	critical
92359	Apple iOS < 9.3.3 Multiple Vulnerabilities	Nessus	Mobile Devices	Local	critical

Detections

Analytics

CVE-2016-4635

medium

Tenable Plugins

high

high

critical

critical

critical