PT-2017-1292 · Apple · Ios

Biren V. Soni + 2 · Published 2017-02-20 · Updated 2017-07-27 · CVE-2016-7634

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions iOS versions prior to 10.2

Description The issue involves the Accessibility component, which accepts spoken passwords without considering that they are locally audible. This could potentially allow a local attacker to cause a denial of service or have other impacts on the system. The vulnerability is related to the lack of protection for service data in the Accessibility component of the iOS operating system.

Recommendations For iOS versions prior to 10.2, consider disabling the spoken password feature in the Accessibility component as a temporary workaround until a patch is available. Restrict access to the Accessibility component to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2017-00411

CVE-2016-7634

Affected Products

Ios

References · 6

• https://osv.dev/vulnerability/CVE-2016-7634 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00411 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-7634 · Security Note
• http://securitytracker.com/id/1037429 · Note
• https://support.apple.com/HT207422 · Note
• http://securityfocus.com/bid/94850 · Note