CVE-2016-4670

Vulnerability

The vulnerability resides in the Security component of iOS (versions before 10.1) and macOS (versions before 10.12.1). It causes the lengths of arbitrary passwords to be written to a log file, which can be accessed by a local user.

Exploitation

An attacker with local access to the affected system can read the relevant log file to obtain the length of any password processed by the system. No special privileges or user interaction beyond local access are required.

Impact

By learning the length of a password, an attacker can significantly reduce the search space for brute-force attacks, aiding in password recovery or unauthorized access. The confidentiality of password metadata is compromised.

Mitigation

Apple addressed this issue in iOS 10.1 [2] and macOS 10.12.1 [1]. Users should update their devices to these or later versions. No workarounds have been published.