A vulnerability was found in Apple iOS up to 10.1.1 (Smartphone Operating System) and classified as critical. Affected by this issue is an unknown function of the component Mail. The manipulation with an unknown input leads to a 7pk security vulnerability. Using CWE to declare the problem leads to CWE-254. Impacted is integrity.

The bug was discovered 12/13/2016. The weakness was released 12/12/2016 by Miguel Alvarado with NCC Group as HT207422 as confirmed advisory (Website). The advisory is shared for download at support.apple.com. This vulnerability is handled as CVE-2016-4689 since 05/11/2016. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 10/05/2022). It is expected to see the exploit prices for this product increasing in the near future.The MITRE ATT&CK project declares the attack technique as T1211. The advisory points out:

S/MIME policy failed to check if a certificate was valid. This issue was addressed by notifying a user if an email was signed with a revoked certificate.

Upgrading to version 10.2 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Entries connected to this vulnerability are available at 93760, 94138, 94129 and 94130.

Productinfo

Type

• Smartphone Operating System

Vendor

• Apple

Name

• iOS

Version

• 10.1.0
• 10.1.1

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion