CVE-2016-4739

Vulnerability

In Apple OS X versions prior to 10.12, the mDNSResponder component, when VMnet.framework is active, configures a DNS proxy to listen on all network interfaces rather than only on the intended interface. This affects systems using VMnet.framework (for virtualization). The issue was fixed in macOS Sierra 10.12 [1].

Exploitation

An attacker on any network interface connected to the affected system can send a crafted DNS query to that interface. No authentication is required, and the attacker must be in a position to send network traffic to the exposed DNS proxy listener.

Impact

A remote attacker can obtain sensitive information by sending a DNS query to an unintended interface, causing the DNS proxy to forward the query and potentially leak details about internal network resolution or the existence of specific hosts [1].

Mitigation

Apple addressed the issue in macOS Sierra 10.12, released September 20, 2016 [1]. Users should update to OS X 10.12 or later. No workarounds have been published; disabling VMnet.framework if not needed may reduce exposure.