PT-2015-3117 · Apple · Tvos+2

Macdefender · Published 2015-12-11 · Updated 2019-03-08 · CVE-2015-7058

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 9.2 Apple OS X versions prior to 10.11.2 Apple tvOS versions prior to 9.1

Description The issue is related to improper validation of keychain item Access Control Lists (ACLs), which can be exploited by attackers using a crafted app to gain access to keychain items. This can potentially allow a remote attacker to obtain access to security keys.

Recommendations For Apple iOS versions prior to 9.2, update to version 9.2 or later. For Apple OS X versions prior to 10.11.2, update to version 10.11.2 or later. For Apple tvOS versions prior to 9.1, update to version 9.1 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2016-00327

CVE-2015-7058

Affected Products

Os X

Ios

Tvos

References · 9

• https://support.apple.com/HT205640 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html · Vendor Advisory
• https://support.apple.com/HT205637 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html · Vendor Advisory
• https://support.apple.com/HT205635 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00327 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-7058 · Security Note
• http://securitytracker.com/id/1034344 · Note