Vulnerabilities > CVE-2016-4735 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple Tvos

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-3166-1. The text 
# itself is copyright (C) Canonical, Inc. See 
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
# trademark of Canonical, Inc.
#

include("compat.inc");

if (description)
{
  script_id(96406);
  script_version("3.11");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/07/14");

  script_cve_id("CVE-2016-4613", "CVE-2016-4657", "CVE-2016-4666", "CVE-2016-4707", "CVE-2016-4728", "CVE-2016-4733", "CVE-2016-4734", "CVE-2016-4735", "CVE-2016-4759", "CVE-2016-4760", "CVE-2016-4761", "CVE-2016-4762", "CVE-2016-4764", "CVE-2016-4765", "CVE-2016-4767", "CVE-2016-4768", "CVE-2016-4769", "CVE-2016-7578");
  script_xref(name:"USN", value:"3166-1");

  script_name(english:"Ubuntu 16.04 LTS : webkit2gtk vulnerabilities (USN-3166-1)");
  script_summary(english:"Checks dpkg output for updated packages.");

  script_set_attribute(
    attribute:"synopsis",
    value:
"The remote Ubuntu host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description",
    value:
"A large number of security issues were discovered in the WebKitGTK+
Web and JavaScript engines. If a user were tricked into viewing a
malicious website, a remote attacker could exploit a variety of issues
related to web browser security, including cross-site scripting
attacks, denial of service attacks, and arbitrary code execution.

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://usn.ubuntu.com/3166-1/"
  );
  script_set_attribute(
    attribute:"solution",
    value:
"Update the affected libjavascriptcoregtk-4.0-18 and / or
libwebkit2gtk-4.0-37 packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'WebKit not_number defineProperties UAF');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libjavascriptcoregtk-4.0-18");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libwebkit2gtk-4.0-37");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/08/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/01/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/01/11");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"Ubuntu Security Notice (C) 2017-2020 Canonical, Inc. / NASL script (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Ubuntu Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("ubuntu.inc");
include("misc_func.inc");

if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/Ubuntu/release");
if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
release = chomp(release);
if (! preg(pattern:"^(16\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 16.04", "Ubuntu " + release);
if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);

flag = 0;

if (ubuntu_check(osver:"16.04", pkgname:"libjavascriptcoregtk-4.0-18", pkgver:"2.14.2-0ubuntu0.16.04.1")) flag++;
if (ubuntu_check(osver:"16.04", pkgname:"libwebkit2gtk-4.0-37", pkgver:"2.14.2-0ubuntu0.16.04.1")) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : ubuntu_report_get()
  );
  exit(0);
}
else
{
  tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libjavascriptcoregtk-4.0-18 / libwebkit2gtk-4.0-37");
}

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(93776);
  script_version("1.13");
  script_cvs_date("Date: 2019/11/14");

  script_cve_id(
    "CVE-2016-4611",
    "CVE-2016-4658",
    "CVE-2016-4702",
    "CVE-2016-4708",
    "CVE-2016-4712",
    "CVE-2016-4718",
    "CVE-2016-4725",
    "CVE-2016-4726",
    "CVE-2016-4728",
    "CVE-2016-4730",
    "CVE-2016-4733",
    "CVE-2016-4734",
    "CVE-2016-4735",
    "CVE-2016-4737",
    "CVE-2016-4738",
    "CVE-2016-4753",
    "CVE-2016-4759",
    "CVE-2016-4765",
    "CVE-2016-4766",
    "CVE-2016-4767",
    "CVE-2016-4768",
    "CVE-2016-4772",
    "CVE-2016-4773",
    "CVE-2016-4774",
    "CVE-2016-4775",
    "CVE-2016-4776",
    "CVE-2016-4777",
    "CVE-2016-4778",
    "CVE-2016-5131"
  );
  script_bugtraq_id(
    92053,
    93054,
    93057,
    93059,
    93063,
    93064,
    93065,
    93067
  );

  script_name(english:"Apple TV < 10 Multiple Vulnerabilities");
  script_summary(english:"Checks the build number.");

  script_set_attribute(attribute:"synopsis", value:
"The remote Apple TV device is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its banner, the version of Apple TV on the remote device
is prior to 10. It is, therefore, affected by multiple vulnerabilities
in the following components :

  - Audio
  - CFNetwork
  - CoreCrypto
  - FontParser
  - IOAcceleratorFamily
  - Kernel
  - libxml2
  - libxslt
  - Security
  - WebKit

Note that only 4th generation models are affected by these
vulnerabilities.");
  script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT207142");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apple TV version 10 or later. Note that this update is only
available for 4th generation models.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-4702");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/07/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/09/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/09/28");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apple:apple_tv");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("appletv_version.nasl");
  script_require_keys("AppleTV/Version", "AppleTV/Model", "AppleTV/URL", "AppleTV/Port");
  script_require_ports("Services/www", 7000);

  exit(0);
}

include("audit.inc");
include("appletv_func.inc");

url = get_kb_item('AppleTV/URL');
if (empty_or_null(url)) exit(0, 'Cannot determine Apple TV URL.');
port = get_kb_item('AppleTV/Port');
if (empty_or_null(port)) exit(0, 'Cannot determine Apple TV port.');

build = get_kb_item('AppleTV/Version');
if (empty_or_null(build)) audit(AUDIT_UNKNOWN_DEVICE_VER, 'Apple TV');

model = get_kb_item('AppleTV/Model');
if (empty_or_null(model)) exit(0, 'Cannot determine Apple TV model.');

fixed_build = "14T330";
tvos_ver = '10';

# determine gen from the model
gen = APPLETV_MODEL_GEN[model];

appletv_check_version(
  build          : build,
  fix            : fixed_build,
  affected_gen   : 4,
  fix_tvos_ver   : tvos_ver,
  model          : model,
  gen            : gen,
  port           : port,
  url            : url,
  severity       : SECURITY_HOLE
);

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(93721);
  script_version("1.6");
  script_cvs_date("Date: 2018/07/14  1:59:36");

  script_cve_id(
    "CVE-2016-4611",
    "CVE-2016-4618",
    "CVE-2016-4728",
    "CVE-2016-4729",
    "CVE-2016-4730",
    "CVE-2016-4731",
    "CVE-2016-4733",
    "CVE-2016-4734",
    "CVE-2016-4735",
    "CVE-2016-4737",
    "CVE-2016-4751",
    "CVE-2016-4758",
    "CVE-2016-4759",
    "CVE-2016-4760",
    "CVE-2016-4762",
    "CVE-2016-4763",
    "CVE-2016-4765",
    "CVE-2016-4766",
    "CVE-2016-4767",
    "CVE-2016-4768",
    "CVE-2016-4769"
  );
  script_bugtraq_id(
    93053,
    93057,
    93058,
    93062,
    93064,
    93065,
    93066,
    93067
  );
  script_xref(name:"APPLE-SA", value:"APPLE-SA-2016-09-20-2");

  script_name(english:"Mac OS X : Apple Safari < 10.0 Multiple Vulnerabilities");
  script_summary(english:"Checks the Safari version.");

  script_set_attribute(attribute:"synopsis", value:
"A web browser installed on the remote host is affected by multiple
vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Apple Safari installed on the remote Mac OS X or macOS
host is prior to 10.0. It is, therefore, affected by multiple
vulnerabilities :

  - Multiple memory corruption issues exist in WebKit that
    allow an unauthenticated, remote attacker to cause a
    denial of service condition or execute arbitrary code
    via specially a crafted website. (CVE-2016-4611,
    CVE-2016-4729, CVE-2016-4730, CVE-2016-4731,
    CVE-2016-4734, CVE-2016-4735, CVE-2016-4737,
    CVE-2016-4759, CVE-2016-4762, CVE-2016-4766,
    CVE-2016-4767, CVE-2016-4768, CVE-2016-4769)

  - A cross-site scripting (XSS) vulnerability exists in the
    Reader feature due to improper validation of
    user-supplied input before returning it to users. An
    unauthenticated, remote attacker can exploit this, by
    convincing a user to follow a specially crafted link, to
    execute arbitrary script code in a user's browser
    session. (CVE-2016-4618)

  - A flaw exists in WebKit due to improper handling of
    error prototypes. An unauthenticated, remote attacker
    can exploit this, via a specially crafted website, to
    execute arbitrary code. (CVE-2016-4728)

  - Multiple flaws exist in WebKit due to improper state
    management. An unauthenticated, remote attacker
    can exploit this, via a specially crafted website, to
    cause a denial of service condition or the execution of
    arbitrary code. (CVE-2016-4733, CVE-2016-4765)

  - An address bar spoofing vulnerability exists due to a
    state management flaw related to sessions in tabs. An
    unauthenticated, remote attacker can exploit this, via a
    specially crafted website, to spoof an address in the
    address bar. (CVE-2016-4751)

  - A flaw exists in WebKit due to improper handling of the
    location variable. An unauthenticated, remote attacker
    can exploit this, via a crafted website, to disclose
    sensitive information. (CVE-2016-4758)

  - A flaw exists in WebKit that allows an unauthenticated,
    remote attacker to conduct DNS rebinding attacks against
    non-HTTP Safari sessions by leveraging HTTP/0.9 support.
    (CVE-2016-4760)

  - A flaw exists in WebKit in the WKWebView component due
    to improper validation of X.509 certificates from HTTPS
    servers. A man-in-the-middle attacker can exploit this,
    via a crafted certificate, to disclose sensitive
    information. (CVE-2016-4763)");
  script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT207157");
  # http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1c557615");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apple Safari version 10.0 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/09/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/09/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/09/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apple:safari");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2016-2018 Tenable Network Security, Inc.");

  script_dependencies("macosx_Safari31.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version", "MacOSX/Safari/Installed");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
os = get_kb_item("Host/MacOSX/Version");
if (!os) audit(AUDIT_OS_NOT, "Mac OS X / macOS");

if (!ereg(pattern:"Mac OS X 10\.1([0-2])([^0-9]|$)", string:os))
  audit(AUDIT_OS_NOT, "Mac OS X 10.10 / 10.11 or macOS 10.12");

installed = get_kb_item_or_exit("MacOSX/Safari/Installed", exit_code:0);
path    = get_kb_item_or_exit("MacOSX/Safari/Path", exit_code:1);
version = get_kb_item_or_exit("MacOSX/Safari/Version", exit_code:1);

fixed_version = "10.0";

if (ver_compare(ver:version, fix:fixed_version, strict:FALSE) == -1)
{
  report = report_items_str(
    report_items:make_array(
      "Path", path,
      "Installed version", version,
      "Fixed version", fixed_version
    ),
    ordered_fields:make_list("Path", "Installed version", "Fixed version")
  );
  security_report_v4(port:0, severity:SECURITY_HOLE, xss:TRUE, extra:report);
}
else audit(AUDIT_INST_PATH_NOT_VULN, "Safari", version, path);