Code execution vulnerability in Apple Software Update

Описание

Weak networking protocol usage was found in Apple Software Update. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via man-in-the-middle attack.

---

Technical details

Instead of usage HTTPS for downloading updates unprotected HTTP protocol was used. This vulnerability can lead to update data-stream spoofing.

Первичный источник обнаружения

• Apple Security Update
  

Связанные продукты

• Apple-Software-Update

Список CVE

• CVE-2016-1731
  warning

Смотрите также

Узнай статистику распространения уязвимостей в своем регионе statistics.securelist.com