Vulnerabilities > CVE-2016-7604 - NULL Pointer Dereference vulnerability in Apple mac OS X

047910
CVSS 4.9 - MEDIUM
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
COMPLETE
local
low complexity
apple
CWE-476
nessus

Summary

An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "CoreCapture" component. It allows local users to cause a denial of service (NULL pointer dereference) via unspecified vectors.

Vulnerable Configurations

Part Description Count
OS
Apple
102

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2016-007.NASL
    descriptionThe remote host is running a version of Mac OS X 10.10.5 or 10.11.6 that is missing a security update. It is therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists in the ssl_parse_clienthello_tlsext() function within file ssl/t1_lib.c when handling oversize OCSP Status Request extensions from clients. An unauthenticated, remote attacker can exploit this to cause memory exhaustion in a process linked with the library. (CVE-2016-6304) - A memory corruption issue exists in Bluetooth due to improper validation of user-supplied input. A local attacker can exploit this, via a specially crafted application, to cause a denial of service condition or the execution of arbitrary code with kernel level privileges. (CVE-2016-7596) - A NULL pointer dereference flaw exists in the CoreCapture component due to improper validation of user-supplied input. A local attacker can exploit this to cause a denial of service condition. (CVE-2016-7604)
    last seen2020-06-01
    modified2020-06-02
    plugin id95918
    published2016-12-16
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95918
    titleMac OS X Multiple Vulnerabilities (Security Updates 2016-003 / 2016-007)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(95918);
      script_version("1.4");
      script_cvs_date("Date: 2019/11/13");
    
      script_cve_id("CVE-2016-6304", "CVE-2016-7596", "CVE-2016-7604");
      script_bugtraq_id(93150, 94903);
      script_xref(name:"APPLE-SA", value:"APPLE-SA-2016-12-13-1");
    
      script_name(english:"Mac OS X Multiple Vulnerabilities (Security Updates 2016-003 / 2016-007)");
      script_summary(english:"Checks for the presence of Security Update 2016-003 and 2016-007.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote host is missing a Mac OS X update that fixes multiple
    security vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote host is running a version of Mac OS X 10.10.5 or 10.11.6
    that is missing a security update. It is therefore, affected by
    multiple vulnerabilities :
    
      - A denial of service vulnerability exists in the
        ssl_parse_clienthello_tlsext() function within file
        ssl/t1_lib.c when handling oversize OCSP Status Request
        extensions from clients. An unauthenticated, remote
        attacker can exploit this to cause memory exhaustion in
        a process linked with the library. (CVE-2016-6304)
    
      - A memory corruption issue exists in Bluetooth due to
        improper validation of user-supplied input. A local
        attacker can exploit this, via a specially crafted
        application, to cause a denial of service condition or
        the execution of arbitrary code with kernel level
        privileges. (CVE-2016-7596)
    
      - A NULL pointer dereference flaw exists in the
        CoreCapture component due to improper validation of
        user-supplied input. A local attacker can exploit this
        to cause a denial of service condition. (CVE-2016-7604)");
      script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT207423");
      # http://lists.apple.com/archives/security-announce/2016/Dec/msg00003.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?38dabd46");
      script_set_attribute(attribute:"solution", value:
    "Install Security Update 2016-007 (OS X 10.10.5) / 2016-003 (OS X
    10.11.6) or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-7596");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/09/22");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/12/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/12/16");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version", "Host/MacOSX/packages/boms");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    
    # Compare 2 patch numbers to determine if patch requirements are satisfied.
    # Return true if this patch or a later patch is applied
    # Return false otherwise
    function check_patch(year, number)
    {
      local_var p_split = split(patch, sep:"-");
      local_var p_year  = int( p_split[0]);
      local_var p_num   = int( p_split[1]);
    
      if (year >  p_year) return TRUE;
      else if (year <  p_year) return FALSE;
      else if (number >=  p_num) return TRUE;
      else return FALSE;
    }
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    os = get_kb_item("Host/MacOSX/Version");
    if (!os) audit(AUDIT_OS_NOT, "Mac OS X");
    if (!ereg(pattern:"Mac OS X 10\.(10\.5|11\.6)([^0-9]|$)", string:os)) audit(AUDIT_OS_NOT, "Mac OS X 10.10.5 or Mac OS X 10.11.6");
    
    if ( "10.10.5" >< os) patch = "2016-007";
    else if ( "10.11.6" >< os ) patch = "2016-003";
    
    packages = get_kb_item_or_exit("Host/MacOSX/packages/boms", exit_code:1);
    sec_boms_report = egrep(pattern:"^com\.apple\.pkg\.update\.(security\.|os\.SecUpd).*bom$", string:packages);
    sec_boms = split(sec_boms_report, sep:'\n');
    
    foreach package (sec_boms)
    {
      # Grab patch year and number
      match = eregmatch(pattern:"[^0-9](20[0-9][0-9])[-.]([0-9]{3})[^0-9]", string:package);
      if (empty_or_null(match[1]) || empty_or_null(match[2]))
        continue;
    
      patch_found = check_patch(year:int(match[1]), number:int(match[2]));
      if (patch_found) exit(0, "The host has Security Update " + patch + " or later installed and is therefore not affected.");
    }
    
    report =  '\n  Missing security update : ' + patch;
    report += '\n  Installed security BOMs : ';
    if (sec_boms_report) report += str_replace(find:'\n', replace:'\n                            ', string:sec_boms_report);
    else report += 'n/a';
    report += '\n';
    
    security_report_v4(port:0, severity:SECURITY_HOLE, extra:report);
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOS_10_12_2.NASL
    descriptionThe remote host is running a version of macOS that is 10.12.x prior to 10.12.2. It is, therefore, affected by multiple vulnerabilities in the following components : - apache_mod_php - AppleGraphicsPowerManagement - Assets - Audio - Bluetooth - CoreCapture - CoreFoundation - CoreGraphics - CoreMedia External Displays - CoreMedia Playback - CoreStorage - CoreText - curl - Directory Services - Disk Images - FontParser - Foundation - Grapher - ICU - ImageIO - Intel Graphics Driver - IOFireWireFamily - IOAcceleratorFamily - IOHIDFamily - IOKit - IOSurface - Kernel - kext tools - libarchive - LibreSSL - OpenLDAP - OpenPAM - OpenSSL - Power Management - Security - syslog - WiFi - xar Note that successful exploitation of the most serious issues can result in arbitrary code execution. Furthermore, CVE-2016-6304, CVE-2016-7596, and CVE-2016-7604 also affect Mac OS X versions 10.10.5 and 10.11.6. However, this plugin does not check those versions.
    last seen2020-06-01
    modified2020-06-02
    plugin id95917
    published2016-12-16
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95917
    titlemacOS 10.12.x < 10.12.2 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(95917);
      script_version("1.9");
      script_cvs_date("Date: 2020/01/07");
    
      script_cve_id(
        "CVE-2016-1777",
        "CVE-2016-1823",
        "CVE-2016-4688",
        "CVE-2016-4691",
        "CVE-2016-4693",
        "CVE-2016-5419",
        "CVE-2016-5420",
        "CVE-2016-5421",
        "CVE-2016-6303",
        "CVE-2016-6304",
        "CVE-2016-7141",
        "CVE-2016-7167",
        "CVE-2016-7411",
        "CVE-2016-7412",
        "CVE-2016-7413",
        "CVE-2016-7414",
        "CVE-2016-7416",
        "CVE-2016-7417",
        "CVE-2016-7418",
        "CVE-2016-7588",
        "CVE-2016-7591",
        "CVE-2016-7594",
        "CVE-2016-7595",
        "CVE-2016-7596",
        "CVE-2016-7600",
        "CVE-2016-7602",
        "CVE-2016-7603",
        "CVE-2016-7604",
        "CVE-2016-7605",
        "CVE-2016-7606",
        "CVE-2016-7607",
        "CVE-2016-7608",
        "CVE-2016-7609",
        "CVE-2016-7612",
        "CVE-2016-7615",
        "CVE-2016-7616",
        "CVE-2016-7617",
        "CVE-2016-7618",
        "CVE-2016-7619",
        "CVE-2016-7620",
        "CVE-2016-7621",
        "CVE-2016-7622",
        "CVE-2016-7624",
        "CVE-2016-7625",
        "CVE-2016-7627",
        "CVE-2016-7628",
        "CVE-2016-7629",
        "CVE-2016-7633",
        "CVE-2016-7636",
        "CVE-2016-7637",
        "CVE-2016-7643",
        "CVE-2016-7644",
        "CVE-2016-7655",
        "CVE-2016-7657",
        "CVE-2016-7658",
        "CVE-2016-7659",
        "CVE-2016-7660",
        "CVE-2016-7661",
        "CVE-2016-7662",
        "CVE-2016-7663",
        "CVE-2016-7714",
        "CVE-2016-7742",
        "CVE-2016-7761",
        "CVE-2016-8615",
        "CVE-2016-8616",
        "CVE-2016-8617",
        "CVE-2016-8618",
        "CVE-2016-8619",
        "CVE-2016-8620",
        "CVE-2016-8621",
        "CVE-2016-8622",
        "CVE-2016-8623",
        "CVE-2016-8624",
        "CVE-2016-8625"
      );
      script_bugtraq_id(
        85054,
        90698,
        92292,
        92306,
        92309,
        92754,
        92975,
        92984,
        93004,
        93005,
        93006,
        93007,
        93008,
        93009,
        93011,
        93150,
        94094,
        94096,
        94097,
        94098,
        94100,
        94101,
        94102,
        94103,
        94105,
        94106,
        94107,
        94572,
        94903,
        94904,
        94905,
        94906
      );
      script_xref(name:"APPLE-SA", value:"APPLE-SA-2016-12-13-1");
    
      script_name(english:"macOS 10.12.x < 10.12.2 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of macOS.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote host is missing a macOS update that fixes multiple security
    vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote host is running a version of macOS that is 10.12.x prior to
    10.12.2. It is, therefore, affected by multiple vulnerabilities in the
    following components :
    
      - apache_mod_php
      - AppleGraphicsPowerManagement
      - Assets
      - Audio
      - Bluetooth
      - CoreCapture
      - CoreFoundation
      - CoreGraphics
      - CoreMedia External Displays
      - CoreMedia Playback
      - CoreStorage
      - CoreText
      - curl
      - Directory Services
      - Disk Images
      - FontParser
      - Foundation
      - Grapher
      - ICU
      - ImageIO
      - Intel Graphics Driver
      - IOFireWireFamily
      - IOAcceleratorFamily
      - IOHIDFamily
      - IOKit
      - IOSurface
      - Kernel
      - kext tools
      - libarchive
      - LibreSSL
      - OpenLDAP
      - OpenPAM
      - OpenSSL
      - Power Management
      - Security
      - syslog
      - WiFi
      - xar
    
    Note that successful exploitation of the most serious issues can
    result in arbitrary code execution.
    
    Furthermore, CVE-2016-6304, CVE-2016-7596, and CVE-2016-7604 also
    affect Mac OS X versions 10.10.5 and 10.11.6. However, this plugin
    does not check those versions.");
      script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT207423");
      # http://lists.apple.com/archives/security-announce/2016/Dec/msg00003.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?38dabd46");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to macOS version 10.12.2 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-7644");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/03/21");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/12/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/12/16");
    
      script_set_attribute(attribute:"plugin_type", value:"combined");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:macos");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl", "os_fingerprint.nasl");
      script_require_ports("Host/MacOSX/Version", "Host/OS");
    
      exit(0);
    }
    
    include("vcf.inc");
    include("vcf_extras_apple.inc");
    
    app_info = vcf::apple::get_macos_info();
    
    vcf::apple::check_macos_restrictions(restrictions:['10.12']);
    
    constraints = [{ "fixed_version" : "10.12.2" }];
    
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);