Information disclosure in Apple iOS

1) Information disclosure

EUVDB-ID: #VU1068

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7579

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to obtain potentially sensistive information on the target system.
The weakness is due to improper handling of proxy credentials. By removing unsolicited proxy password authentication prompts, attackers can cause memory leak and access valid user's credentials.
Successfull exploitation of the vulnerability leads to disclosure of importnat data on the vulnerable system.

Mitigation

Update to version 10.1.

Vulnerable software versions

Apple iOS: 9.0.0 - 10.0.1

External links

http://support.apple.com/en-us/HT207271

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.