An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the "Security" component, which allows man-in-the-middle attackers to cause a denial of service (application crash) via vectors related to OCSP responder URLs.

Versions of Apple TV earlier than 10.1 are affected by multiple vulnerabilities in the following components :

 - 3DES
 - Audio
 - Audio
 - Certificates
 - CoreFoundation
 - CoreGraphics
 - CoreMedia External Displays
 - CoreMedia Playback
 - CoreText
 - FontParser
 - ICU
 - IOHDIXController
 - IOHIDFamily
 - IOKit 
 - ImageIO
 - kernel
 - libarchive
 - OCSP
 - Power Management
 - Profiles
 - WebKit
 - WebKit

The version of iOS running on the mobile device is prior to 10.2, and is affected by multiple vulnerabilities in the following components :

 - 3DES
 - Accessibility 
 - Accounts
 - Audio
 - Certificates
 - Clipboard
 - CoreFoundation
 - CoreGraphics
 - CoreMedia External Displays
 - CoreMedia Playback
 - CoreText 
 - Find My iPhone
 - FontParser
 - Graphics Driver
 - ICU
 - Image Capture
 - ImageIO
 - IOHDIXController
 - IOHIDFamily
 - IOKit 152301)
 - kernel
 - libarchive
 - Local Authentication
 - MIG
 - Media Player
 - OCSP
 - Power Management
 - Profiles
 - S/MIME
 - SpringBoard
 - syslog
 - WebKit 
 - WebSheet

The remote host is running a version of macOS that is 10.12.x prior to 10.12.2. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - AppleGraphicsPowerManagement
  - Assets
  - Audio
  - Bluetooth
  - CoreCapture
  - CoreFoundation
  - CoreGraphics
  - CoreMedia External Displays
  - CoreMedia Playback
  - CoreStorage
  - CoreText
  - curl
  - Directory Services
  - Disk Images
  - FontParser
  - Foundation
  - Grapher
  - ICU
  - ImageIO
  - Intel Graphics Driver
  - IOFireWireFamily
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - IOSurface
  - Kernel
  - kext tools
  - libarchive
  - LibreSSL
  - OpenLDAP
  - OpenPAM
  - OpenSSL
  - Power Management
  - Security
  - syslog
  - WiFi
  - xar

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Furthermore, CVE-2016-6304, CVE-2016-7596, and CVE-2016-7604 also affect Mac OS X versions 10.10.5 and 10.11.6. However, this plugin does not check those versions.

The version of Apple iOS running on the mobile device is prior to 10.2. It is, therefore, affected by multiple vulnerabilities in the following components :

  - Accessibility
  - Accounts
  - Audio
  - CoreFoundation
  - CoreGraphics
  - CoreMedia External Displays
  - CoreMedia Playback
  - CoreText
  - Disk Images
  - Find My iPhone
  - FontParser
  - Graphics Driver
  - ICU
  - Image Capture
  - ImageIO
  - IOHIDFamily
  - IOKit
  - Kernel
  - libarchive
  - Local Authentication
  - Mail
  - Media Player
  - Power Management
  - Profiles
  - Safari Reader
  - Security
  - SpringBoard
  - syslog
  - WebKit

ID	Name	Product	Family	Severity
9848	Apple TV < 10.1 Multiple Vulnerabilities	Nessus Network Monitor	Internet Services	high
9847	Apple iOS < 10.2 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
95917	macOS 10.12.x < 10.12.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
95826	Apple iOS < 10.2 Multiple Vulnerabilities	Nessus	Mobile Devices	high

Detections

Analytics

CVE-2016-7636

medium

Tenable Plugins

high

high

high

high