CVE-2016-4664

Vulnerability

The vulnerability resides in the Sandbox Profiles component of Apple iOS (before 10.1), tvOS (before 10.0.1), and watchOS (before 3.1). It allows a maliciously crafted application to bypass sandbox restrictions and read metadata from the photo directory [1][2][3]. The issue is present on iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later, Apple TV (4th generation), and all Apple Watch models [1][2][3].

Exploitation

An attacker must convince a user to install a crafted app on an affected device. No additional authentication or network position is required beyond the app's ability to execute on the device. The app can then access photo-directory metadata, such as timestamps or file names, without the user's explicit consent [1][2][3].

Impact

Successful exploitation results in unauthorized disclosure of photo-directory metadata. The attacker gains read access to metadata that the sandbox should have protected, compromising confidentiality. The integrity and availability of the system remain unaffected [1][2][3].

Mitigation

Apple released fixes as part of iOS 10.1, tvOS 10.0.1, and watchOS 3.1 on October 24, 2016 [1][2][3]. Users should update their devices to these versions or later to remediate the vulnerability. No workaround is available for earlier versions.