PT-2017-1310 · Apple · Apple Macos

Sweetchip · Published 2017-02-20 · Updated 2017-02-21 · CVE-2016-4780

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions macOS versions prior to 10.12.1

Description The issue involves the "Thunderbolt" component and allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app. It is related to pointer dereference errors.

Recommendations For macOS versions prior to 10.12.1, update to version 10.12.1 or later to resolve the issue. As a temporary workaround, consider disabling the Thunderbolt component until a patch is available. Restrict access to the Thunderbolt interface to minimize the risk of exploitation. Avoid using crafted apps that may trigger the NULL pointer dereference.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2017-00434

CVE-2016-4780

Affected Products

Apple Macos

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-4780 · Security Note
• https://osv.dev/vulnerability/CVE-2016-4780 · Vendor Advisory
• https://support.apple.com/HT207275 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00434 · Security Note