PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-4670 Apple CVE debrief

CVE-2016-4670 is a low-severity Apple information-disclosure issue in the Security component. According to the NVD and Apple advisories, a local user could read a log and learn the length of arbitrary passwords. The issue was fixed in iOS 10.1 and macOS 10.12.1. This does not indicate direct password disclosure or remote compromise, but it can still aid local reconnaissance and account-targeting efforts.

Vendor
Apple
Product
CVE-2016-4670
CVSS
LOW 3.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-20
Original CVE updated
2026-05-13
Advisory published
2017-02-20
Advisory updated
2026-05-13

Who should care

Apple device administrators, endpoint security teams, and users of affected iPhone/iPad and Mac systems should care, especially where local account access or shared access to logs is possible.

Technical summary

NVD describes the flaw as a local information leak with CVSS 3.0 vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability affects iOS versions before 10.1 and macOS versions before 10.12.1, with NVD CPE ranges showing iPhone OS through 10.0.3 and macOS through 10.12.0. The disclosure appears limited to password length information obtained by reading a log; no integrity or availability impact is indicated in the supplied sources.

Defensive priority

Low. Patch promptly on any still-supported or unpatched Apple systems, but this issue is primarily an information disclosure rather than a direct compromise path.

Recommended defensive actions

  • Update iOS devices to 10.1 or later.
  • Update macOS systems to 10.12.1 or later.
  • Review whether local users can access relevant logs or log exports on shared systems.
  • Apply least-privilege controls to local accounts and administrative access.
  • Reduce unnecessary log exposure and retention where operationally feasible.
  • Confirm fleet compliance against the affected version ranges in the advisory.

Evidence notes

The description and version bounds come from the supplied CVE record and NVD metadata: iOS before 10.1 and macOS before 10.12.1. NVD’s CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, consistent with a local confidentiality-only issue. The source corpus includes Apple vendor advisories (support.apple.com/HT207271 and support.apple.com/HT207275) and a SecurityFocus reference, but no exploit details beyond log-based password-length disclosure.

Official resources

Publicly disclosed and published in the official CVE/NVD record on 2017-02-20. The supplied timeline indicates that date as the preferred display date; later modified metadata does not change the original disclosure date.