NVD Vulnerability Detail

CVE-2016-1720

Summary	IOKit in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
Publication Date	Feb. 1, 2016, 8:59 p.m.
Registration Date	Jan. 26, 2021, 2:07 p.m.
Last Update	Nov. 21, 2024, 11:46 a.m.

CVSS3.0 : HIGH
スコア	7.8
Vector	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	低
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高

CVSS2.0 : HIGH
Score	7.2
Vector	AV:L/AC:L/Au:N/C:C/I:C/A:C
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:apple:mac_os_x::::::::					10.11.3

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:apple:tvos::::::::					9.1.1

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:apple:iphone_os::::::::					9.2.1

Configuration4		or higher	or less	more than	less than
cpe:2.3:o:apple:watchos::::::::					2.2

Related information, measures and tools

No	URL	タグ
1	http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html	Mailing List Vendor Advisory
2	http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html	Mailing List Vendor Advisory
3	http://lists.apple.com/archives/security-announce/2016/Jan/msg00003.html	Mailing List Vendor Advisory
4	http://lists.apple.com/archives/security-announce/2016/Jan/msg00003.html	Mailing List Vendor Advisory
5	http://lists.apple.com/archives/security-announce/2016/Jan/msg00005.html	Mailing List Vendor Advisory
6	http://lists.apple.com/archives/security-announce/2016/Jan/msg00005.html	Mailing List Vendor Advisory
7	http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html	Mailing List Vendor Advisory
8	http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html	Mailing List Vendor Advisory
9	http://packetstormsecurity.com/files/135435/IOKit-Methods-Being-Called-Without-Locks-From-IOServiceClose.html	Third Party Advisory VDB Entry
10	http://packetstormsecurity.com/files/135435/IOKit-Methods-Being-Called-Without-Locks-From-IOServiceClose.html	Third Party Advisory VDB Entry
11	http://www.securitytracker.com/id/1034736	Third Party Advisory VDB Entry
12	http://www.securitytracker.com/id/1034736	Third Party Advisory VDB Entry
13	https://code.google.com/p/google-security-research/issues/detail?id=597	Exploit
14	https://code.google.com/p/google-security-research/issues/detail?id=597	Exploit
15	https://support.apple.com/HT205729	Vendor Advisory
16	https://support.apple.com/HT205729	Vendor Advisory
17	https://support.apple.com/HT205731	Vendor Advisory
18	https://support.apple.com/HT205731	Vendor Advisory
19	https://support.apple.com/HT205732	Vendor Advisory
20	https://support.apple.com/HT205732	Vendor Advisory
21	https://support.apple.com/HT206168	Vendor Advisory
22	https://support.apple.com/HT206168	Vendor Advisory
23	https://www.exploit-db.com/exploits/39367/	Exploit Third Party Advisory VDB Entry
24	https://www.exploit-db.com/exploits/39367/	Exploit Third Party Advisory VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

JVN Vulnerability Information

複数の Apple 製品の IOKit における権限を取得される脆弱性

Title	複数の Apple 製品の IOKit における権限を取得される脆弱性
Summary	Apple iOS、OS X、および tvOS の IOKit には、権限を取得される、またはサービス運用妨害 (メモリ破損) 状態にされる脆弱性が存在します。
Possible impacts	ローカルユーザにより、権限を取得される、またはサービス運用妨害 (メモリ破損) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 19, 2016, midnight
Registration Date	Feb. 17, 2016, 1:59 p.m.
Last Update	March 29, 2016, 3:44 p.m.

Affected System

アップル

Apple Mac OS X v10.11 から v10.11.2

iOS 9.2.1 未満 (iPad 2 以降)

iOS 9.2.1 未満 (iPhone 4s 以降)

iOS 9.2.1 未満 (iPod touch 第 5 世代以降)

tvOS 9.1.1 未満 (Apple TV 第 4 世代)

watchOS 2.2 未満 (Apple Watch Edition)

watchOS 2.2 未満 (Apple Watch Hermes)

watchOS 2.2 未満 (Apple Watch Sport)

watchOS 2.2 未満 (Apple Watch)

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-1720	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1720
National Vulnerability Database (NVD)
2	CVE-2016-1720	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1720

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
Apple
1	Apple security updates	https://support.apple.com/en-us/HT201222
Apple Mailing Lists
2	APPLE-SA-2016-01-19-1 iOS 9.2.1	http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html
3	APPLE-SA-2016-01-19-2 OS X El Capitan 10.11.3 and Security Update 2016-001	http://lists.apple.com/archives/security-announce/2016/Jan/msg00003.html
4	APPLE-SA-2016-01-25-1 tvOS 9.1.1	http://lists.apple.com/archives/security-announce/2016/Jan/msg00005.html
5	APPLE-SA-2016-03-21-2 watchOS 2.2	http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html
Apple Security Updates
6	HT205729	https://support.apple.com/en-us/HT205729
7	HT205731	https://support.apple.com/en-us/HT205731
8	HT205732	https://support.apple.com/en-us/HT205732
9	HT206168	https://support.apple.com/en-us/HT206168
Apple セキュリティアップデート
10	HT205729	https://support.apple.com/ja-jp/HT205729
11	HT205731	https://support.apple.com/ja-jp/HT205731
12	HT205732	https://support.apple.com/ja-jp/HT205732
13	HT206168	http://support.apple.com/ja-jp/HT206168
Chromium
14	Issue 597	https://bugs.chromium.org/p/project-zero/issues/detail?id=597&redir=1

その他

No	Name	URL
JVN
1	JVNVU#90405245	http://jvn.jp/vu/JVNVU90405245/index.html
2	JVNVU#97668313	http://jvn.jp/vu/JVNVU97668313/index.html

Change Log

No	Changed Details	Date of change
0	[2016年02月17日] 掲載 [2016年03月29日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：アップル (HT206168) を追加ベンダ情報：アップル (APPLE-SA-2016-03-21-2 watchOS 2.2) を追加参考情報：JVN (JVNVU#97668313) を追加	Feb. 17, 2018, 10:37 a.m.