Mail in Apple iOS before 10 mishandles certificates, which makes it easier for man-in-the-middle attackers to discover mail credentials via unspecified vectors.

The version of iOS running on the mobile device is prior to 10.0, and is affected by multiple vulnerabilities in the following components :

 - AppleMobileFileIntegrity (CVE-2016-4698)
 - Assets (CVE-2016-4741)
 - Audio (CVE-2016-4702)
 - CFNetwork (CVE-2016-4707, CVE-2016-4708)
 - CommonCrypto (CVE-2016-4711, CVE-2016-4712)
 - FontParser (CVE-2016-4718)
 - GeoServices (CVE-2016-4719)
 - IDS - Connectivity (CVE-2016-4722)
 - IOAcceleratorFamily (CVE-2016-4724, CVE-2016-4725, CVE-2016-4726)
 - Kernel (CVE-2016-4771, CVE-2016-4772, CVE-2016-4773, CVE-2016-4774, CVE-2016-4776, CVE-2016-4777, CVE-2016-4778)
 - Keyboards (CVE-2016-4746)
 - libxml2 (CVE-2016-4658, CVE-2016-5131)
 - libxslt (CVE-2016-4738)
 - Mail (CVE-2016-4747)
 - Messages (CVE-2016-4740)
 - Printing UIKit (CVE-2016-4749)
 - S2 Camera (CVE-2016-4750)
 - Safari Reader (CVE-2016-4618)
 - Sandbox Profiles (CVE-2016-4620)
 - Security (CVE-2016-4753)
 - Springboard (CVE-2016-7759)
 - WebKit (CVE-2016-4728, CVE-2016-4758, CVE-2016-4611, CVE-2016-4729, CVE-2016-4730, CVE-2016-4731, CVE-2016-4734, CVE-2016-4735, CVE-2016-4737, CVE-2016-4759, CVE-2016-4762, CVE-2016-4766, CVE-2016-4767, CVE-2016-4768, CVE-2016-4760, CVE-2016-4733, CVE-2016-4765, CVE-2016-4763)

The version of iOS running on the mobile device is prior to 10. It is, therefore, affected by multiple vulnerabilities :

  - An access control issue exists in the Sandbox Profiles     component in SMS draft directories that allows a local     attacker to determine who a user is texting by using the     'stat' command on a directory. (CVE-2016-4620)

  - An unspecified permissions issue exists in PlaceData in     the GeoServices component that allows a local attacker,     via a crafted application, to disclose sensitive     information. (CVE-2016-4719)

  - A flaw exists in the Messages component in the Handoff     for Messages functionality due to incorrectly exposing     messages even while signed out. A physically present     attacker can exploit this to disclose sensitive     information. (CVE-2016-4740)

  - A flaw exists in the Assets component due to updates     being sent over unencrypted channels. A     man-in-the-middle attacker can exploit this to block a     device from receiving software updates. (CVE-2016-4741)

  - A flaw exists in the Keyboards component due to the     Keyboard Autocorrect Suggestion feature inadvertently     caching sensitive information. A physically present     attacker can exploit this to disclose sensitive     information. (CVE-2016-4746)

  - A flaw exists in the Mail component due to improper     handling of untrusted certificates. A man-in-the-middle     attacker can exploit this to disclose credential     information. (CVE-2016-4747)

  - A flaw exists in the Printing UIKit component when     writing an unencrypted document to a temporary file when     using AirPrint preview. A local attacker can exploit     this to disclose sensitive information. (CVE-2016-4749)

  - A flaw exists in the Springboard component due to cached     application snapshots being displayed in the task     switcher. A local attacker can exploit this to disclose     sensitive information. (CVE-2016-7759)

  - A flaw exists related to the BlueTooth subsystem that     could allow remote code execution as well as     man-in-the-middle attacks. This issue is also known as     'BlueBorne'.

ID	Name	Product	Family	Severity
9619	Apple iOS < 10.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical
93515	Apple iOS < 10 Multiple Vulnerabilities (BlueBorne)	Nessus	Mobile Devices	high

Detections

Analytics

CVE-2016-4747

low

Tenable Plugins

critical

high