Apple iOS < 10.3.2 Multiple Vulnerabilities

Critical Nessus Network Monitor Plugin ID 700116

Synopsis

The remote host is running a version of Apple iOS that is affected by multiple attack vectors.

Description

The version of iOS running on the mobile device is prior to 10.3.2, and is affected by multiple vulnerabilities :

- A use-after-free error exists in the handling of RenderElement objects. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code. (OSVDB 157533)
- A use-after-free error exists in the handling of RenderLayer objects. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code. (OSVDB 157535)
- A use-after-free error exists in the handling of RenderInline objects. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code. (OSVDB 157537)
- A flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (OSVDB 157531, OSVDB 157532, OSVDB 157534, OSVDB 157536, OSVDB 157538, OSVDB 157539, OSVDB 157540, OSVDB 157541, OSVDB 157543, OSVDB 157544, OSVDB 157545, OSVDB 157546)
- An unspecified flaw exists related to the certificate trust policy that is triggered when handling trust acceptance. This may allow a context-dependent attacker to potentially cause untrusted certificates to be treated as trusted. (OSVDB 157559)
- An unspecified flaw exists in the Safari history menu. With a specially crafted web page, a context-dependent attacker can cause an application denial of service. (OSVDB 157569)
- A logic flaw exists that allows a universal cross-site scripting (UXSS) attack. The issue is triggered when handling WebKit Editor commands. This may allow a context-dependent attacker to create a specially crafted web page that will execute arbitrary script code in a user's browser session within the trust relationship between their browser and any website. (OSVDB 157600, OSVDB 157601, OSVDB 157602, OSVDB 157603, OSVDB 157604)
- A type confusion flaw exists in SQLite that is triggered as certain input related to 'snippet' is not properly validated. With specially crafted web content, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (OSVDB 158290, OSVDB 158291, OSVDB 158292)

This product is also affected by vulnerabilities found in the following components:

- AVEVideoEncoder (OSVDB 157566, OSVDB 157869, OSVDB 157870, OSVDB 157871, OSVDB 157872, OSVDB 157873, OSVDB 157874)
- CoreAudio (OSVDB 157552)
- CoreFoundation (OSVDB 157894)
- Foundation (OSVDB 157895)
- iBooks (OSVDB 157548, OSVDB 157551)
- IOSurface (OSVDB 157550)
- Kernel (OSVDB 157547, OSVDB 157549, OSVDB 157554)
- TextInput (OSVDB 157553)
- Notifications (OSVDB 157555)
- SQLite (OSVDB 157560, OSVDB 157561, OSVDB 157562, OSVDB 157563, OSVDB 157564, OSVDB 157565)
- WebKit (OSVDB 157590)
- Web Inspector (OSVDB 157667)

Solution

Upgrade to Apple iOS 10.3.2 or later.

See Also

https://support.apple.com/en-us/HT207798

Plugin Details

Severity: Critical

ID: 700116

File Name: 700116.prm

Published: 2017/05/17

Modified: 2017/05/31

Dependencies: 8637

Risk Information

Risk Factor: Critical

CVSSv2

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

CVSSv3

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS3#E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:apple:iphone_os

Patch Publication Date: 2017/05/15

Vulnerability Publication Date: 2017/05/15

Reference Information

CVE: CVE-2017-2495, CVE-2017-2496, CVE-2017-2497, CVE-2017-2498, CVE-2017-2499, CVE-2017-2501, CVE-2017-2502, CVE-2017-2504, CVE-2017-2505, CVE-2017-2506, CVE-2017-2507, CVE-2017-2508, CVE-2017-2510, CVE-2017-2513, CVE-2017-2514, CVE-2017-2515, CVE-2017-2518, CVE-2017-2519, CVE-2017-2520, CVE-2017-2521, CVE-2017-2522, CVE-2017-2523, CVE-2017-2524, CVE-2017-2525, CVE-2017-2526, CVE-2017-2528, CVE-2017-2530, CVE-2017-2531, CVE-2017-2536, CVE-2017-2538, CVE-2017-2539, CVE-2017-2547, CVE-2017-2549, CVE-2017-6979, CVE-2017-6980, CVE-2017-6981, CVE-2017-6982, CVE-2017-6983, CVE-2017-6984, CVE-2017-6987, CVE-2017-6989, CVE-2017-6991, CVE-2017-6994, CVE-2017-6995, CVE-2017-6996, CVE-2017-6997, CVE-2017-6998, CVE-2017-6999, CVE-2017-7000, CVE-2017-7001, CVE-2017-7002

BID: 98584, 98588