Product:
iOS
Summary
The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app. This vulnerability can lead to complete confidentiality impact, exposing sensitive data to unauthorized access. It requires user interaction to exploit, making it a medium complexity attack.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2016-4655 |
Exploitation
To exploit this vulnerability, an attacker must create a malicious application that, when installed and executed by the user, can access sensitive information stored in the device’s memory. The attacker needs to trick the user into installing the app, which can be done through social engineering or by distributing the app through untrusted sources.
Affected Products
- iOS versions before 9.3.5: Vulnerable to memory information disclosure through crafted applications.
Mitigation
Users are advised to apply updates as per vendor instructions to mitigate this vulnerability. Keeping the iOS version up to date will help protect against potential exploits.
References
- Apple Security Announcement – August 2016
- Apple Security Announcement – September 2016
- SecurityFocus BID 92651
- SecurityFocus BID 92965
- SecurityTracker ID 1036694
- Lookout Blog on Trident Pegasus
- Apple Support Document HT207107
- Apple Support Document HT207145
- Exploit-DB Exploit 44836
- CISA Known Exploited Vulnerabilities Catalog