Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-7579: Apple iOS, macOS, tvOS let attackers steal proxy passwords

CVE-2016-7579 · published 9 years ago

Summary

Older versions of Apple’s iOS, macOS, and tvOS can be tricked into accepting a fake proxy password request. This lets a man‑in‑the‑middle attacker capture the password and other private data. Update the devices to the latest software versions to protect against this risk.

What to do

Update apple iphone_os to version 10.1 or later.
Update apple mac_os_x to version 10.12.1 or later.
Update apple tvos to version 10.0.1 or later.

Affected software

Vendor	Product	Affected versions
apple	iphone_os	< 10.1 `cpe:2.3:o:apple:iphone_os::::::::`
apple	mac_os_x	< 10.12.1 `cpe:2.3:o:apple:mac_os_x::::::::`
apple	tvos	< 10.0.1 `cpe:2.3:o:apple:tvos::::::::`

Original advisory text

An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. The issue involves the "CFNetwork Proxies" component, which allows man-in-the-middle attackers to spoof a proxy password authentication requirement and obtain sensitive information.

References

http://www.securityfocus.com/bid/93856 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1037086 Third Party Advisory VDB Entry
https://support.apple.com/HT207270 Vendor Advisory
https://support.apple.com/HT207271 Vendor Advisory
https://support.apple.com/HT207275 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.9 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published20 Feb 2017

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2016-7579 · NVD

Track software like this

Free during beta