IOAcceleratorFamily in Apple OS X before 10.11.2 and tvOS before 9.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

According to its banner, the version of the remote Apple TV device is prior to 9.1. It is, therefore, affected by multiple vulnerabilities in the following components :

  - AppleMobileFileIntegrity
  - Compression
  - CoreGraphics
  - CoreMedia Playback
  - Disk Images
  - dyld
  - ImageIO
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit SCSI
  - Kernel
  - libarchive
  - libc
  - libxml2
  - MobileStorageMounter
  - OpenGL
  - Security
  - WebKit

Note that only 4th generation models are affected by the vulnerabilities.

The remote host is running a version of iOS 9.3.x prior to version 9.3.3, and the following components contain vulnerabilities :

 - CFNetwork
 - libxml2
 - WebKit
 - CoreGraphics
 - FaceTime
 - ImageIO
 - IOHIDFamily
 - Sandbox
 - Kernel
 - libxslt
 - Calender
 - IOAcceleratorFamily
 - Safari
 - Siri Contacts
 - Web Media

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.2 and the following components contain vulnerabilities :

 - IOAcceleratorFamily
 - Kernel
 - SecurityConfiguration Profiles
 - Keychain Access

Versions of Apple TV earlier than 9.1 are vulnerable to the following issues :

 - A flaw exists within the 'IOAcceleratorFamily' component. This may allow a local attacker to corrupt memory and potentially execute arbitrary code with system privileges. (CVE-2015-7109)
 - A use-after-free condition is triggered when parsing disk images. This may allow a local attacker to dereference already freed memory and potentially execute arbitrary code with kernel privileges. (CVE-2015-7110)
 - A memory corruption vulnerability exists within the 'ASN.1 decoder'. The issue is triggered as user-supplied input is not properly validated when handling a specially crafted certificate. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-7059, CVE-2015-7060, CVE-2015-7061)
 - A flaw exists due to the program failing to properly perform authorization checks. This may allow a local attacker to install arbitrary configuration profiles. (CVE-2015-7062)
 - A flaw exists within legacy functionality that is triggered in the way Keychain access interacts with the Keychain agent. This may allow a local attacker to spoof as a valid Keychain server. (CVE-2015-7045)

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.2 and is affected by multiple vulnerabilities in the following components :

 - apache_mod_php
 - AppSandbox
 - Bluetooth
 - CFNetwork HTTPProtocol
 - Compression
 - Configuration Profiles
 - CoreGraphics
 - CoreMedia Playback
 - Disk Images
 - EFI
 - File Bookmark
 - Hypervisor
 - iBooks
 - ImageIO
 - Intel Graphics Driver
 - IOAcceleratorFamily
 - IOHIDFamily
 - IOKit SCSI
 - IOThunderboltFamily
 - Kernel
 - kext tools
 - Keychain Access
 - libarchive
 - libc
 - libexpat
 - libxml2
 - OpenGL
 - OpenLDAP
 - OpenSSH
 - QuickLook
 - Sandbox
 - Security
 - System Integrity Protection

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.9.5 or 10.10.5 that is missing Security Update 2015-005 or 2015-008. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - AppSandbox
  - Bluetooth
  - CFNetwork HTTPProtocol
  - Compression
  - Configuration Profiles
  - CoreGraphics
  - CoreMedia Playback
  - Disk Images
  - EFI
  - File Bookmark
  - Hypervisor
  - iBooks
  - ImageIO
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit SCSI
  - IOThunderboltFamily
  - Kernel
  - kext tools
  - Keychain Access
  - libarchive
  - libc
  - libexpat
  - libxml2
  - OpenGL
  - OpenLDAP
  - OpenSSH
  - QuickLook
  - Sandbox
  - Security
  - System Integrity Protection

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X that is 10.11.x prior to 10.11.2. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - AppSandbox
  - Bluetooth
  - CFNetwork HTTPProtocol
  - Compression
  - Configuration Profiles
  - CoreGraphics
  - CoreMedia Playback
  - Disk Images
  - EFI
  - File Bookmark
  - Hypervisor
  - iBooks
  - ImageIO
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit SCSI
  - IOThunderboltFamily
  - Kernel
  - kext tools
  - Keychain Access
  - libarchive
  - libc
  - libexpat
  - libxml2
  - OpenGL
  - OpenLDAP
  - OpenSSH
  - QuickLook
  - Sandbox
  - Security
  - System Integrity Protection

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	Name	Product	Family	Severity
94050	Apple TV < 9.1 Multiple Vulnerabilities	Nessus	Misc.	medium
9445	Apple iOS 9.3.x < 9.3.3 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
9438	Mac OS X 10.11.x < 10.11.2 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	high
9433	Apple TV < 9.1 Multiple Vulnerabilities	Nessus Network Monitor	Internet Services	high
9325	Mac OS X 10.11.x < 10.11.2 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
87321	Mac OS X Multiple Vulnerabilities (Security Updates 2015-005 / 2015-008)	Nessus	MacOS X Local Security Checks	critical
87314	Mac OS X 10.11.x < 10.11.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2015-7109

high

Tenable Plugins

medium

high

high

high

critical

critical

critical