CVE-2016-7584
HighSummary
An issue was discovered in certain Apple products that allows remote attackers to spoof signed code using a matching team ID. Affects iOS before 10.1, macOS before 10.12.1, tvOS before 10.0.1, and watchOS before 3.1.
Risk Assessment
Organizations may be vulnerable to attacks that exploit this vulnerability to execute malicious code, potentially leading to data loss or device takeover.
Recommendation
It is recommended to update all affected systems to the latest versions to mitigate the risks associated with this vulnerability.
Other vulnerabilities in AppleMobileFileIntegrity
See all- CVE-2016-4698High
AppleMobileFileIntegrity in Apple iOS before version 10 and OS X before version 10.12 mishandles process entitlement and Team ID values in the task port inheritance policy, allowing attackers to execute arbitrary code in a privileged context.
- CVE-2015-7055High
AppleMobileFileIntegrity in Apple iOS before 9.2 and tvOS before 9.1 does not prevent changes to access-control structures, allowing attackers to execute arbitrary code in a privileged context via a crafted app.
Original NVD description (English source)
An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the "AppleMobileFileIntegrity" component, which allows remote attackers to spoof signed code by using a matching team ID.