An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. macOS before 10.12.3 is affected. tvOS before 10.1.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (use-after-free) via a crafted app.

Versions of Apple TV earlier than 10.1.1 are affected by multiple vulnerabilities in the following components :

 - CoreText
 - Kernel 
 - syslog
 - WebKit

The remote host is running a version of Mac OS X version 10.x prior to 10.12.3, and is affected by multiple vulnerabilities in the following components :

 - Bluetooth (CVE-2017-2353)
 - Graphics Drivers (CVE-2017-2358)
 - Help Viewer (CVE-2017-2361)
 - IOAudioFamily (CVE-2017-2357)
 - Kernel (CVE-2017-2360, CVE-2017-2370)

The version of iOS running on the mobile device is prior to 10.2.1, and is affected by multiple vulnerabilities :

 - A prototype access flaw exists that is triggered when handling exceptions. With specially crafted web content, a context-dependent attacker may exfiltrate cross-origin data. (CVE-2017-2350)
 - A flaw exists in WiFi that is triggered when handling user input. This may allow a physically present attacker to bypass the lock and briefly access the home screen. (CVE-2017-2351)
 - A logic flaw exists related to state management in Auto Unlock. This may allow a physically present attacker to potentially unlock a watch when it is off the user's wrist. (CVE-2017-2352)
 - A type confusion flaw exists that is triggered as input is not properly validated when handling 'SearchInputType' objects. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2017-2354)
 - An unspecified memory initialization flaw exists that may allow a context-dependent attacker to potentially execute arbitrary code. No further details have been provided. (CVE-2017-2355)
 - A flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2017-2356, CVE-2017-2362, CVE-2017-2366, CVE-2017-2369, CVE-2017-2373)
 - A use-after-free error exists in the 'host_self_trap' mach trap. This may allow a local attacker to dereference already freed memory and gain elevated privileges. (CVE-2017-2360)
 - A flaw exists that is triggered as input is not properly validated when handling page loading. This may allow a context-dependent attacker to exfiltrate cross-origin data. (CVE-2017-2363, CVE-2017-2364)
 - A flaw exists that is triggered as input is not properly validated when handling variables. This may allow a context-dependent attacker to exfiltrate cross-origin data. (CVE-2017-2365)
 - A flaw exists in Contacts that is triggered as input is not properly validated during the handling of a specially crafted contact card. This may allow a context-dependent attacker to crash the system. (CVE-2017-2368)
 - An overflow condition exists in the 'mach_voucher_extract_attr_recipe_trap()' function that is triggered as certain input is not properly validated. This may allow a local attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2017-2370)
 - An unspecified flaw exists that may allow a context-dependent attacker to bypass popup restrictions via a specially crafted website. No further details have been provided. (CVE-2017-2371)

According to its banner, the version of Apple TV on the remote device is prior to 10.1.1. It is, therefore, affected by multiple vulnerabilities :

  - A stack-based buffer overflow condition exists in     libarchive in the bsdtar_expand_char() function within     file util.c due to improper validation of certain     unspecified input. An unauthenticated, remote attacker     can exploit this, via a specially crafted archive, to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-8687)

  - A prototype access flaw exists in WebKit when handling     exceptions. An unauthenticated, remote attacker can     exploit this, via specially crafted web content, to     disclose cross-origin data. (CVE-2017-2350)

  - A type confusion error exists in WebKit when handling     SearchInputType objects due to improper validation of     certain unspecified input. An unauthenticated, remote     attacker can exploit this, via specially crafted web     content, to execute arbitrary code. (CVE-2017-2354)

  - An unspecified memory initialization flaw exists in     WebKit that allows an unauthenticated, remote attacker     to execute arbitrary code via specially crafted web     content. (CVE-2017-2355)

  - Multiple memory corruption issues exist in WebKit due to     improper validation of certain unspecified input. An     unauthenticated, remote attacker can exploit these, via     specially crafted web content, to execute arbitrary     code. (CVE-2017-2356, CVE-2017-2362, CVE-2017-2369,     CVE-2017-2373)

  - A use-after-free error exists in the host_self_trap mach     trap. A local attacker can exploit this, via a specially     crafted application, to dereference already freed memory     and thereby execute arbitrary code with kernel     privileges. (CVE-2017-2360)

  - A flaw exists in WebKit when handling page loading due     to improper validation of certain unspecified input.
    An unauthenticated, remote attacker can exploit this,     via specially crafted web content, to disclose     cross-origin data. (CVE-2017-2363)

  - A flaw exists in WebKit when handling variables due     to improper validation of certain unspecified input.
    An unauthenticated, remote attacker can exploit this,     via specially crafted web content, to disclose     cross-origin data. (CVE-2017-2365)

  - A heap buffer overflow condition exists in the     mach_voucher_extract_attr_recipe_trap() function due to     improper validation of certain unspecified input. A     local attacker can exploit this, via a specially     crafted application, to cause a denial of service     condition or the execution of arbitrary code with     kernel privileges. (CVE-2017-2370)

Note that only 4th generation models are affected by these vulnerabilities.

The remote host is running a version of macOS that is 10.12.x prior to 10.12.3. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - Bluetooth
  - Graphics Drivers
  - Help Viewer
  - IOAudioFamily
  - Kernel
  - libarchive
  - Vim
  - WebKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The version of Apple iOS running on the mobile device is prior to 10.2.1. It is, therefore, affected by multiple vulnerabilities in multiple components, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these remote code execution vulnerabilities by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user. The affected components are as follows :

  - Auto Unlock
  - Contacts
  - Kernel
  - libarchive
  - WebKit
  - WiFi

ID	Name	Product	Family	Severity
9932	Apple TV < 10.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Internet Services	high
9930	Mac OS X 10.x < 10.12.3 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	high
9929	Apple iOS < 10.2.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
96877	Apple TV < 10.1.1 Multiple Vulnerabilities	Nessus	Misc.	high
96731	macOS 10.12.x < 10.12.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
96730	Apple iOS < 10.2.1 Multiple Vulnerabilities	Nessus	Mobile Devices	high

Detections

Analytics

CVE-2017-2360

high

Tenable Plugins

high

high

high

high

high

high