PT-2016-2021 · Apple · Ios+3

Richard Shupak · Published 2016-05-20 · Updated 2016-12-01 · CVE-2016-1842

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MapKit in Apple iOS versions prior to 9.3.2 MapKit in Apple OS X versions prior to 10.11.5 MapKit in Apple watchOS versions prior to 2.2.1

Description The issue is related to MapKit not using HTTPS for shared links, allowing remote attackers to obtain sensitive information by sniffing the network for HTTP traffic. This can enable a remote attacker to gain confidential information by listening to network traffic.

Recommendations For iOS versions prior to 9.3.2, update to version 9.3.2 or later. For OS X versions prior to 10.11.5, update to version 10.11.5 or later. For watchOS versions prior to 2.2.1, update to version 2.2.1 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2016-01355

CVE-2016-1842

Affected Products

Mapkit

Os X

Ios

Watchos

References · 10

• https://support.apple.com/HT206566 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2016/May/msg00004.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2016/May/msg00002.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1842 · Vendor Advisory
• https://support.apple.com/HT206567 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01355 · Security Note
• http://lists.apple.com/archives/security-announce/2016/May/msg00003.html · Vendor Advisory
• https://support.apple.com/HT206568 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1842 · Security Note
• http://securitytracker.com/id/1035890 · Note