PT-2017-1310 · Apple · Apple Macos

Sweetchip · Publicado 2017-02-20 · Atualizado 2017-02-21 · CVE-2016-4780

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions macOS versions prior to 10.12.1

Description The issue involves the "Thunderbolt" component and allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app. It is related to pointer dereference errors.

Recommendations For macOS versions prior to 10.12.1, update to version 10.12.1 or later to resolve the issue. As a temporary workaround, consider disabling the Thunderbolt component until a patch is available. Restrict access to the Thunderbolt interface to minimize the risk of exploitation. Avoid using crafted apps that may trigger the NULL pointer dereference.

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

BDU:2017-00434

CVE-2016-4780

Produtos afetados

Apple Macos

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-4780 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-4780 · Aviso do Fabricante
• https://support.apple.com/HT207275 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-00434 · Nota de Segurança