PT-2016-2021 · Apple · Ios+3

Richard Shupak · Publicado 2016-05-20 · Atualizado 2016-12-01 · CVE-2016-1842

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MapKit in Apple iOS versions prior to 9.3.2 MapKit in Apple OS X versions prior to 10.11.5 MapKit in Apple watchOS versions prior to 2.2.1

Description The issue is related to MapKit not using HTTPS for shared links, allowing remote attackers to obtain sensitive information by sniffing the network for HTTP traffic. This can enable a remote attacker to gain confidential information by listening to network traffic.

Recommendations For iOS versions prior to 9.3.2, update to version 9.3.2 or later. For OS X versions prior to 10.11.5, update to version 10.11.5 or later. For watchOS versions prior to 2.2.1, update to version 2.2.1 or later.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2016-01355

CVE-2016-1842

Produtos afetados

Mapkit

Os X

Ios

Watchos

Referências · 10

• https://support.apple.com/HT206566 · Aviso do Fabricante
• http://lists.apple.com/archives/security-announce/2016/May/msg00004.html · Aviso do Fabricante
• http://securitytracker.com/id/1035890 · Nota
• http://lists.apple.com/archives/security-announce/2016/May/msg00002.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-1842 · Aviso do Fabricante
• https://support.apple.com/HT206567 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-01355 · Nota de Segurança
• http://lists.apple.com/archives/security-announce/2016/May/msg00003.html · Aviso do Fabricante
• https://support.apple.com/HT206568 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1842 · Nota de Segurança