CVE-2016-1773

Vulnerability

The code-signing subsystem in Apple OS X before version 10.11.4 does not properly verify file ownership, enabling a local user to determine whether arbitrary files exist on the system [1]. The issue affects OS X El Capitan v10.11 to v10.11.3, as well as OS X Mavericks v10.9.5 and OS X Yosemite v10.10.5.

Exploitation

An attacker must have local access to the system. No special privileges are required beyond a standard user account. By leveraging the unspecified vectors in the code-signing subsystem, the attacker can probe for the existence of files without proper ownership checks.

Impact

Successful exploitation allows a local user to determine the existence of arbitrary files on the system, leading to information disclosure. The attacker does not gain read access to file contents, only knowledge of whether a file exists. This could aid in further reconnaissance.

Mitigation

Apple addressed this issue in OS X El Capitan v10.11.4 and Security Update 2016-002, released on March 21, 2016 [1]. Users should update to the latest version. No workarounds are documented.