CVE-2016-4698
HighSummary
AppleMobileFileIntegrity in Apple iOS before version 10 and OS X before version 10.12 mishandles process entitlement and Team ID values in the task port inheritance policy, allowing attackers to execute arbitrary code in a privileged context.
Risk Assessment
Exploitation of this vulnerability could lead to malicious applications gaining control over the system, posing a serious threat to user data security.
Recommendation
It is recommended to update iOS to version 10 or later and OS X to version 10.12 or later to mitigate the risks associated with this vulnerability.
Other vulnerabilities in AppleMobileFileIntegrity
See all- CVE-2016-7584High
An issue was discovered in certain Apple products that allows remote attackers to spoof signed code using a matching team ID. Affects iOS before 10.1, macOS before 10.12.1, tvOS before 10.0.1, and watchOS before 3.1.
- CVE-2015-7055High
AppleMobileFileIntegrity in Apple iOS before 9.2 and tvOS before 9.1 does not prevent changes to access-control structures, allowing attackers to execute arbitrary code in a privileged context via a crafted app.
Original NVD description (English source)
AppleMobileFileIntegrity in Apple iOS before 10 and OS X before 10.12 mishandles process entitlement and Team ID values in the task port inheritance policy, which allows attackers to execute arbitrary code in a privileged context via a crafted app.