WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to conduct DNS rebinding attacks against non-HTTP Safari sessions by leveraging HTTP/0.9 support.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote     attackers to conduct DNS rebinding attacks against non-HTTP Safari sessions by leveraging HTTP/0.9     support. (CVE-2016-4760)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3166-1 advisory.

    A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user     were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related     to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary     code execution.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes running on the remote Windows host is prior to 12.5.1. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists due to     improper handling of error prototypes. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a maliciously crafted     website, to execute arbitrary code. (CVE-2016-4728)

  - An information disclosure vulnerability exists in WebKit     due to a permission issue caused by improper handling of     the location variable. An unauthenticated, remote     attacker can exploit this, by convincing a user to visit     a maliciously crafted website, to disclose sensitive     information. (CVE-2016-4758)

  - Multiple memory corruption errors exist in WebKit due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     issues, by convincing a user to visit a maliciously     crafted website, to cause a denial of service condition     or the execution of arbitrary code. (CVE-2016-4759,     CVE-2016-4762, CVE-2016-4764, CVE-2016-4765,     CVE-2016-4766, CVE-2016-4767, CVE-2016-4768,     CVE-2016-4769)

  - A rebinding flaw exists in WebKit due to a failure to     restrict HTTP/0.9 responses to default ports and     cancel resource loads if a document is loaded with a     different HTTP protocol version. An unauthenticated,     remote attacker can exploit this, by convincing a user     to visit a maliciously crafted website, to access     non-HTTP services. (CVE-2016-4760)

  - A security bypass vulnerability exists in WebKit in the     WKWebView component due to a failure to properly verify     X.509 certificates from HTTPS servers. A     man-in-the-middle attacker can exploit this, via a     specially crafted certificate, to spoof servers and     disclose or manipulate network traffic. (CVE-2016-4763)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes installed on the remote Windows host is prior to 12.5.1. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists due to     improper handling of error prototypes. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a maliciously crafted     website, to execute arbitrary code. (CVE-2016-4728)

  - An information disclosure vulnerability exists in WebKit     due to a permission issue caused by improper handling of     the location variable. An unauthenticated, remote     attacker can exploit this, by convincing a user to visit     a maliciously crafted website, to disclose sensitive     information. (CVE-2016-4758)

  - Multiple memory corruption errors exist in WebKit due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     issues, by convincing a user to visit a maliciously     crafted website, to cause a denial of service condition     or the execution of arbitrary code. (CVE-2016-4759,     CVE-2016-4762, CVE-2016-4764, CVE-2016-4765,     CVE-2016-4766, CVE-2016-4767, CVE-2016-4768,     CVE-2016-4769)

  - A rebinding flaw exists in WebKit due to a failure to     restrict HTTP/0.9 responses to default ports and     cancel resource loads if a document is loaded with a     different HTTP protocol version. An unauthenticated,     remote attacker can exploit this, by convincing a user     to visit a maliciously crafted website, to access     non-HTTP services. (CVE-2016-4760)

  - A security bypass vulnerability exists in WebKit in the     WKWebView component due to a failure to properly verify     X.509 certificates from HTTPS servers. A     man-in-the-middle attacker can exploit this, via a     specially crafted certificate, to spoof servers and     disclose or manipulate network traffic. (CVE-2016-4763)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of iTunes prior to 12.5.1 are affected by multiple vulnerabilities in the Webkit component.

Versions of Safari prior to 10 are affected by multiple vulnerabilities in the following components :

 - Reader (CVE-2016-4618) 
 - Tabs (CVE-2016-4751) 
 - Webkit (CVE-2016-4611, CVE-2016-4728, CVE-2016-4729, CVE-2016-4730, CVE-2016-4731, CVE-2016-4733, CVE-2016-4734, CVE-2016-4735, CVE-2016-4737, CVE-2016-4758, CVE-2016-4759, CVE-2016-4760, CVE-2016-4762, CVE-2016-4763, CVE-2016-4765, CVE-2016-4766, CVE-2016-4767, CVE-2016-4768, CVE-2016-4769)

The version of iOS running on the mobile device is prior to 10.0, and is affected by multiple vulnerabilities in the following components :

 - AppleMobileFileIntegrity (CVE-2016-4698)
 - Assets (CVE-2016-4741)
 - Audio (CVE-2016-4702)
 - CFNetwork (CVE-2016-4707, CVE-2016-4708)
 - CommonCrypto (CVE-2016-4711, CVE-2016-4712)
 - FontParser (CVE-2016-4718)
 - GeoServices (CVE-2016-4719)
 - IDS - Connectivity (CVE-2016-4722)
 - IOAcceleratorFamily (CVE-2016-4724, CVE-2016-4725, CVE-2016-4726)
 - Kernel (CVE-2016-4771, CVE-2016-4772, CVE-2016-4773, CVE-2016-4774, CVE-2016-4776, CVE-2016-4777, CVE-2016-4778)
 - Keyboards (CVE-2016-4746)
 - libxml2 (CVE-2016-4658, CVE-2016-5131)
 - libxslt (CVE-2016-4738)
 - Mail (CVE-2016-4747)
 - Messages (CVE-2016-4740)
 - Printing UIKit (CVE-2016-4749)
 - S2 Camera (CVE-2016-4750)
 - Safari Reader (CVE-2016-4618)
 - Sandbox Profiles (CVE-2016-4620)
 - Security (CVE-2016-4753)
 - Springboard (CVE-2016-7759)
 - WebKit (CVE-2016-4728, CVE-2016-4758, CVE-2016-4611, CVE-2016-4729, CVE-2016-4730, CVE-2016-4731, CVE-2016-4734, CVE-2016-4735, CVE-2016-4737, CVE-2016-4759, CVE-2016-4762, CVE-2016-4766, CVE-2016-4767, CVE-2016-4768, CVE-2016-4760, CVE-2016-4733, CVE-2016-4765, CVE-2016-4763)

The version of Apple Safari installed on the remote Mac OS X or macOS host is prior to 10.0. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist in WebKit that     allow an unauthenticated, remote attacker to cause a     denial of service condition or execute arbitrary code     via specially a crafted website. (CVE-2016-4611,     CVE-2016-4729, CVE-2016-4730, CVE-2016-4731,     CVE-2016-4734, CVE-2016-4735, CVE-2016-4737,     CVE-2016-4759, CVE-2016-4762, CVE-2016-4766,     CVE-2016-4767, CVE-2016-4768, CVE-2016-4769)

  - A cross-site scripting (XSS) vulnerability exists in the     Reader feature due to improper validation of     user-supplied input before returning it to users. An     unauthenticated, remote attacker can exploit this, by     convincing a user to follow a specially crafted link, to     execute arbitrary script code in a user's browser     session. (CVE-2016-4618)

  - A flaw exists in WebKit due to improper handling of     error prototypes. An unauthenticated, remote attacker     can exploit this, via a specially crafted website, to     execute arbitrary code. (CVE-2016-4728)

  - Multiple flaws exist in WebKit due to improper state     management. An unauthenticated, remote attacker     can exploit this, via a specially crafted website, to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-4733, CVE-2016-4765)

  - An address bar spoofing vulnerability exists due to a     state management flaw related to sessions in tabs. An     unauthenticated, remote attacker can exploit this, via a     specially crafted website, to spoof an address in the     address bar. (CVE-2016-4751)

  - A flaw exists in WebKit due to improper handling of the     location variable. An unauthenticated, remote attacker     can exploit this, via a crafted website, to disclose     sensitive information. (CVE-2016-4758)

  - A flaw exists in WebKit that allows an unauthenticated,     remote attacker to conduct DNS rebinding attacks against     non-HTTP Safari sessions by leveraging HTTP/0.9 support.
    (CVE-2016-4760)

  - A flaw exists in WebKit in the WKWebView component due     to improper validation of X.509 certificates from HTTPS     servers. A man-in-the-middle attacker can exploit this,     via a crafted certificate, to disclose sensitive     information. (CVE-2016-4763)

ID	Name	Product	Family	Type	Severity
264133	Linux Distros Unpatched Vulnerability : CVE-2016-4760	Nessus	Misc.	Local	medium
96406	Ubuntu 16.04 LTS : WebKitGTK+ vulnerabilities (USN-3166-1)	Nessus	Ubuntu Local Security Checks	Local	critical
94971	Apple iTunes < 12.5.1 Multiple Vulnerabilities (uncredentialed Check)	Nessus	Peer-To-Peer File Sharing	Remote	high
94914	Apple iTunes < 12.5.1 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	Local	high
9709	iTunes < 12.5.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
9708	Safari < 10 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		medium
9619	Apple iOS < 10.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices		critical
93721	Mac OS X : Apple Safari < 10.0 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	critical

Detections

Analytics

CVE-2016-4760

medium

Tenable Plugins

medium

critical

high

high

high

medium

critical

critical