The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

The version of iOS running on the mobile device is prior to 9.3.5, and is affected by multiple vulnerabilities. These vulnerablilities are contained within the Kernel subcomponent.

The remote host is running a version of Mac OS X 10.10.5 or 10.11.6 that is missing a security update. It is therefore, affected by multiple vulnerabilities in the Kernel component :

  - An unspecified flaw exists due to improper validation of     user-supplied input. An attacker can exploit this, by     convincing a user to run a specially crafted     application, to disclose kernel memory contents.
    (CVE-2016-4655)

  - An unspecified flaw exists due to improper validation of     certain input. An attacker can exploit this, by     convincing a user to run a specially crafted     application, to execute arbitrary code with kernel level     privileges. (CVE-2016-4656)

The version of iOS running on the mobile device is prior to 9.3.5. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in the     kernel due to improper sanitization of user-supplied     input. An unauthenticated, remote attacker can exploit     this, by convincing a user to run a specially crafted     application, to disclose sensitive information from     kernel memory. (CVE-2016-4655)

  - A remote code execution vulnerability exists in the     kernel due to a memory corruption issue. An     unauthenticated, remote attacker can exploit this by     convincing a user to run a specially crafted     application, to cause a denial of service condition or     execution of arbitrary code. (CVE-2016-4656)

  - A remote code execution vulnerability exists in WebKit     due to a memory corruption issue. An unauthenticated,     remote attacker can exploit this, by convincing a user     to visit a malicious website, to cause a denial of     service condition or execution of arbitrary code.
    (CVE-2016-4657)

These three zero day vulnerabilities were disclosed on 2016/08/25 and are known to be used by the NSO Group's spyware product Pegasus.

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.6, and the following components contain vulnerabilities :

 - ACMP4AACBaseDecoder
 - Audio
 - CFNetwork
 - CoreGraphics
 - DspFuncLib
 - FaceTime
 - Graphics
 - IOHIDFamily
 - IOSurface
 - ImageIO
 - Kernel
 - QuickTime
 - Safari
 - Sandbox
 - libxml2

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.5 and is affected by multiple vulnerabilities in the following components :

 - Kernel
 - libxml2

ID	Name	Product	Family	Severity
9548	Apple iOS 9.3.x < 9.3.5 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	medium
93317	Mac OS X Multiple Vulnerabilities (Security Updates 2016-001 / 2016-005)	Nessus	MacOS X Local Security Checks	high
93124	Apple iOS < 9.3.5 Multiple Vulnerabilities (Trident)	Nessus	Mobile Devices	high
9441	Mac OS X 10.11.x < 10.11.6 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
9440	Mac OS X 10.11.x < 10.11.5 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	medium

Detections

Analytics

CVE-2016-4656

high

Tenable Plugins

medium

high

high

critical

medium