CVE-2016-5104: Medium severity suse libimobiledevice vulnerability
It was found that libimobiledevice and libusbmuxd libraries accidentally bound a listening IPv4 TCP socket to INADDRANY instead of INADDRLOOPBACK.
This socket is used to communicate with services on an iOS device. The impact is accidental exposure of the iOS device to attackers on the local network. The RHEL workstation itself is not exposed, nor is there an easy escalation for attackers to gain access to the host.
Upstream patches:
libusbmuxd: https://github.com/libimobiledevice/libusbmuxd/commit/4397b3376dc4e4cb1c991d0aed61ce6482614196
libimobiledevice: https://github.com/libimobiledevice/libimobiledevice/commit/df1f5c4d70d0c19ad40072f5246ca457e7f9849e
CVE request:
http://seclists.org/oss-sec/2016/q2/410
Other sources
The socketcreate function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5104?
The severity of CVE-2016-5104 is classified as medium, due to the risk of local network exposure.
How do I fix CVE-2016-5104?
To fix CVE-2016-5104, update the libimobiledevice and libusbmuxd libraries to versions 1.2.1 and 1.0.11 or later.
Who is affected by CVE-2016-5104?
CVE-2016-5104 affects users of libimobiledevice and libusbmuxd on Ubuntu and openSUSE systems.
What does CVE-2016-5104 vulnerability expose?
CVE-2016-5104 exposes an iOS device to unauthorized access from local network attackers.
Is there a workaround for CVE-2016-5104?
A temporary workaround for CVE-2016-5104 is to restrict access to the affected services using firewall rules.