CVE-2016-5104

What it actually does

The socket_create function permits remote IPv4 TCP connections that bypass the intended access controls, enabling direct communication with services on attached iOS devices.

Why it matters to the business

Organizations relying on these libraries for mobile device management face risk of unauthorized interaction with iOS devices, potentially exposing sensitive data or allowing unintended device control in development, testing, or management workflows.

How an attack unfolds

An attacker locates a system running a vulnerable version of libimobiledevice or libusbmuxd, connects directly to an exposed IPv4 TCP socket, and interacts with iOS device services that should have been restricted to local or authenticated access only.

How to fix it

Upgrade libimobiledevice to commit df1f5c4d70d0c19ad40072f5246ca457e7f9849e or later and libusbmuxd to commit 4397b3376dc4e4cb1c991d0aed61ce6482614196 or later; for calico packages update to 3.27.2-r2 or newer.

How to confirm the fix worked

Verify installed package versions against the listed fixed releases or commits; test that only intended local or authenticated connections succeed while remote IPv4 TCP attempts are rejected.

Typical attack path

1. Scan for hosts exposing services from libimobiledevice or libusbmuxd
2. Establish a direct IPv4 TCP connection to the socket_create endpoint
3. Bypass intended restrictions to issue commands or retrieve data from the iOS device

How to detect it

Review network logs and process activity for unexpected inbound TCP connections to ports associated with usbmuxd or libimobiledevice services; examine application logs for socket creation events originating from remote IPv4 addresses.

What your security team should do

• Apply the listed fixed versions across all affected products without delay
• Restrict network exposure of any services using these libraries
• Audit environments for legacy versions still in use