CERT-In Advisory
CIAD-2015-0069
Multiple Vulnerabilities in Apple iOS
Original Issue Date: December 21, 2015
Severity Rating: High
Software Affected
- Apple iOS versions prior to 9.2
Overview
Multiple vulnerabilities have been reported in Apple iOS which could allow an unauthenticated, remote or local attacker to bypass security restrictions, gain unauthorized access, access sensitive information, spoof user interface while visiting websites, bypass the ASLR protection mechanism and execute arbitrary code with elevated privileges to gain complete control of the targeted system.
Description
These vulnerabilities due to improper access control, buffer overflow errors, improper handling of hard links, improper input validation, null pointer dereference, improper memory initialization, memory corruption issues, improper segment validation, improper path validation, improper handling of XML data, Improper handling of URLs, improper privilege separation and improper restriction checks in the AppleMobileFileIntegrity, AppSandbox, CFNetwork HTTPProtocol, Compression, CoreGraphics, CoreMedia Playback, dyld, GPUTools Framework, iBooks, ImageIO, IOHIDFamily, IOKit SCSI, Kernel, LaunchServices, libarchive, libc, libxml2, MobileStorageMounter, OpenGL, Photos, QuickLook, Safari, Sandbox, Security, Siri, and WebKit components of the affected software.
Successful exploitation of these vulnerabilities could allow a remote attacker to bypass security restrictions, gain unauthorized access, access sensitive information, spoof user interface while visiting websites, bypass the ASLR protection mechanism and execute arbitrary code with elevated privileges to gain complete control of the targeted system.
Solution
Apply appropriate security updates as mentioned in the
Apple Security Advisory HT205635
Vendor Information
Apple
http://support.apple.com/en-us/HT205635
References
Cisco
http://tools.cisco.com/security/center/viewAlert.x?alertId=42588
Security Tracker
http://www.securitytracker.com/id/1034348
CVE Name
CVE-2015-7097
CVE-2015-7098
CVE-2015-7099
CVE-2015-7100
CVE-2015-7101
CVE-2015-7102
CVE-2015-7103
CVE-2015-7050
CVE-2015-7069
CVE-2015-7070
CVE-2015-7081
CVE-2015-7053
CVE-2015-7111
CVE-2015-7112
CVE-2015-7068
CVE-2015-7040
CVE-2015-7041
CVE-2015-7042
CVE-2015-7043
CVE-2015-7083
CVE-2015-7084
CVE-2015-7047
CVE-2015-7113
CVE-2011-2895
CVE-2015-7038
CVE-2015-7039
CVE-2015-3807
CVE-2015-7064
CVE-2015-7055
CVE-2015-7001
CVE-2015-7094
CVE-2015-7054
CVE-2015-7105
CVE-2015-7074
CVE-2015-7075
CVE-2015-7072
CVE-2015-7079
CVE-2015-7065
CVE-2015-7066
CVE-2015-7037
CVE-2015-7107
CVE-2015-7093
CVE-2015-7046
CVE-2015-7073
CVE-2015-7058
CVE-2015-7080
CVE-2015-7048
CVE-2015-7095
CVE-2015-7096
CVE-2015-7051
CVE-2015-7115
CVE-2015-7116
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|