In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a downgrade issue existed with HTTP authentication credentials saved in Keychain. This issue was addressed by storing the authentication types with the credentials.

The remote host is running a version of iOS 9.3.x prior to version 9.3.3, and the following components contain vulnerabilities :

 - CFNetwork
 - libxml2
 - WebKit
 - CoreGraphics
 - FaceTime
 - ImageIO
 - IOHIDFamily
 - Sandbox
 - Kernel
 - libxslt
 - Calender
 - IOAcceleratorFamily
 - Safari
 - Siri Contacts
 - Web Media

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.6, and the following components contain vulnerabilities :

 - ACMP4AACBaseDecoder
 - Audio
 - CFNetwork
 - CoreGraphics
 - DspFuncLib
 - FaceTime
 - Graphics
 - IOHIDFamily
 - IOSurface
 - ImageIO
 - Kernel
 - QuickTime
 - Safari
 - Sandbox
 - libxml2

Versions of Apple TV 9.2.x prior to 9.2.2 are affected by multiple vulnerabilities in the following components :

 - CFNetwork
 - CoreGraphics
 - IOAcceleratorFamily
 - IOHIDFamily
 - ImageIO
 - Kernel
 - libxml2
 - libxslt
 - Sandbox

According to its banner, the version of the remote Apple TV device is prior to 9.2.2. It is, therefore, affected by multiple vulnerabilities in the following components :

  - CoreGraphics
  - ImageIO
  - IOAcceleratorFamily
  - IOHIDFamily
  - Kernel
  - libxml2
  - libxslt
  - Sandbox Profiles
  - WebKit
  - WebKit Page Loading

Note that only 4th generation models are affected by the vulnerabilities.

The version of iOS running on the mobile device is prior to 9.3.3. It is, therefore, affected by multiple vulnerabilities, the most serious of which can result in remote code execution, in the following components :

  - Calendar
  - CoreGraphics
  - FaceTime
  - ImageIO
  - IOAcceleratorFamily
  - IOHIDFamily
  - Kernel
  - libxml2
  - libxslt
  - Safari
  - Sandbox Profiles
  - Siri Contacts
  - Web Media
  - WebKit
  - WebKit JavaScript Bindings
  - WebKit Page Loading

ID	Name	Product	Family	Severity
9445	Apple iOS 9.3.x < 9.3.3 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
9441	Mac OS X 10.11.x < 10.11.6 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
9430	Apple TV 9.2.x < 9.2.2 Multiple Vulnerabilities	Nessus Network Monitor	Internet Services	medium
92494	Apple TV < 9.2.2 Multiple Vulnerabilities	Nessus	Misc.	critical
92359	Apple iOS < 9.3.3 Multiple Vulnerabilities	Nessus	Mobile Devices	critical

Detections

Analytics

CVE-2016-4644

medium

Tenable Plugins

high

critical

medium

critical

critical