An issue was discovered in certain Apple products. iOS before 10 is affected. Safari before 10 is affected. iTunes before 12.5.1 is affected. tvOS before 10 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3166-1 advisory.

    A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user     were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related     to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary     code execution.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes running on the remote Windows host is prior to 12.5.1. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists due to     improper handling of error prototypes. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a maliciously crafted     website, to execute arbitrary code. (CVE-2016-4728)

  - An information disclosure vulnerability exists in WebKit     due to a permission issue caused by improper handling of     the location variable. An unauthenticated, remote     attacker can exploit this, by convincing a user to visit     a maliciously crafted website, to disclose sensitive     information. (CVE-2016-4758)

  - Multiple memory corruption errors exist in WebKit due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     issues, by convincing a user to visit a maliciously     crafted website, to cause a denial of service condition     or the execution of arbitrary code. (CVE-2016-4759,     CVE-2016-4762, CVE-2016-4764, CVE-2016-4765,     CVE-2016-4766, CVE-2016-4767, CVE-2016-4768,     CVE-2016-4769)

  - A rebinding flaw exists in WebKit due to a failure to     restrict HTTP/0.9 responses to default ports and     cancel resource loads if a document is loaded with a     different HTTP protocol version. An unauthenticated,     remote attacker can exploit this, by convincing a user     to visit a maliciously crafted website, to access     non-HTTP services. (CVE-2016-4760)

  - A security bypass vulnerability exists in WebKit in the     WKWebView component due to a failure to properly verify     X.509 certificates from HTTPS servers. A     man-in-the-middle attacker can exploit this, via a     specially crafted certificate, to spoof servers and     disclose or manipulate network traffic. (CVE-2016-4763)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes installed on the remote Windows host is prior to 12.5.1. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists due to     improper handling of error prototypes. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a maliciously crafted     website, to execute arbitrary code. (CVE-2016-4728)

  - An information disclosure vulnerability exists in WebKit     due to a permission issue caused by improper handling of     the location variable. An unauthenticated, remote     attacker can exploit this, by convincing a user to visit     a maliciously crafted website, to disclose sensitive     information. (CVE-2016-4758)

  - Multiple memory corruption errors exist in WebKit due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     issues, by convincing a user to visit a maliciously     crafted website, to cause a denial of service condition     or the execution of arbitrary code. (CVE-2016-4759,     CVE-2016-4762, CVE-2016-4764, CVE-2016-4765,     CVE-2016-4766, CVE-2016-4767, CVE-2016-4768,     CVE-2016-4769)

  - A rebinding flaw exists in WebKit due to a failure to     restrict HTTP/0.9 responses to default ports and     cancel resource loads if a document is loaded with a     different HTTP protocol version. An unauthenticated,     remote attacker can exploit this, by convincing a user     to visit a maliciously crafted website, to access     non-HTTP services. (CVE-2016-4760)

  - A security bypass vulnerability exists in WebKit in the     WKWebView component due to a failure to properly verify     X.509 certificates from HTTPS servers. A     man-in-the-middle attacker can exploit this, via a     specially crafted certificate, to spoof servers and     disclose or manipulate network traffic. (CVE-2016-4763)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
96406	Ubuntu 16.04 LTS : WebKitGTK+ vulnerabilities (USN-3166-1)	Nessus	Ubuntu Local Security Checks	critical
94971	Apple iTunes < 12.5.1 Multiple Vulnerabilities (uncredentialed Check)	Nessus	Peer-To-Peer File Sharing	high
94914	Apple iTunes < 12.5.1 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	high

Detections

Analytics

CVE-2016-4764

high

Tenable Plugins

critical

high

high