Multiple Apple Security Updates

Number: AV16-171
Date: 25 October 2016

Purpose

The purpose of this advisory is to bring attention to multiple Apple system security updates for watchOS, tvOS, Safari, macOS Sierra, and iOS.

Assessment

Apple has released the following support articles:
HT207269 - watchOS 3.1 (All Apple Watch models)
HT207270 - tvOS 10.0.1 (Apple TV (4th generation))
HT207272 - Safari 10.0.1 (OS X Yosemite v10.10.5, OS X El Capitan v10.11.6, and macOS Sierra 10.12)
HT207275 - macOS Sierra 10.12.1 (OS X Yosemite v10.10.5, OS X El Capitan v10.11.6, and macOS Sierra)
HT207271 - iOS 10.1 (iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later)

Details: These updates address multiple vulnerabilities, including arbitrary code execution, denial of service, cause a relayed call to continue transmitting audio while appearing as if the call terminated, cause an unexpected system termination or arbitrary code execution in the kernel, disclose kernel memory, disclose sensitive user information, disclosure of process memory, disclosure of user information, elevate privileges, execute arbitrary code with additional privileges, execute arbitrary code with kernel privileges, execute arbitrary code with root privileges, leak sensitive user information, observe the length of a login password when a user logs in, overwrite arbitrary files, relayed call to continue transmitting audio while appearing as if the call terminated, retrieve metadata of audio recording directories and retrieve metadata of photo directories.

Multiple CVEs are referenced, please review Apple's advisory for specific details.

Suggested Action

CCIRC recommends that owners and operators test and deploy the vendor released updates or workarounds to affected platforms referred to in Apple Support Articles HT207269, HT207270, HT207272, HT207275 and HT207271.

References:

https://support.apple.com/en-ca/HT207269
https://support.apple.com/en-ca/HT207270
https://support.apple.com/en-ca/HT207272
https://support.apple.com/en-ca/HT207275
https://support.apple.com/en-ca/HT207271

Note to Readers

In support of Public Safety's mission to build a safe and resilient Canada, CCIRC's mandate is to help ensure the security and resilience of the vital non-federal government cyber systems that underpin Canada's national security, public safety and economic prosperity. As Canada's computer security incident response team, CCIRC is Canada's national coordination centre for the prevention and mitigation of, preparedness for, response to, and recovery from cyber incidents on non-federal government systems. It does this by providing authoritative advice and support, and coordinating information sharing and incident response.

Please note, CCIRC PGP key has recently been updated.
http://www.publicsafety.gc.ca/cnt/ntnl-scrt/cbr-scrt/_fl/CCIRCPublicPGPKey.txt

For general information, please contact Public Safety Canada's Public Affairs division at:

Telephone: 613-944-4875 or 1-800-830-3118
Fax: 613-998-9589
E-mail: ps.communications-communications.sp@canada.ca

Date modified: