CVE-2016-4645

Vulnerability

CFNetwork in Apple OS X before 10.11.6 uses weak permissions for web-browser cookies, which allows local users to obtain sensitive information via unspecified vectors [1]. The issue affects all versions of OS X prior to 10.11.6.

Exploitation

A local attacker with access to the system can leverage the weak permissions to read web-browser cookie files that should be protected. No additional authentication or privilege level is required beyond a standard user account on the affected system [1].

Impact

A local attacker can obtain sensitive information contained in web-browser cookies, potentially including session tokens or authentication data, leading to partial confidentiality compromise. The attack does not require network access and is limited to local information disclosure [1].

Mitigation

Apple addressed this issue in OS X El Capitan v10.11.6, released on July 18, 2016 [1]. Users should update to OS X 10.11.6 or later. No workarounds are documented.