Privilege Elevation, Arbitrary Code Execution, DoS – Apple’s Latest iOS 12.1 Brings Fixes to Several Critical Security Issues
Apple has released a new iPad Pro and MacBook Air today. Along with the new products, the company has also started rolling out iOS 12.1 bringing several new features and quite a long list of security fixes.
In today’s release, iOS 12.1 addresses some critical security vulnerabilities (Apple doesn’t assign its security flaws a severity rating) that include, among others:
- Remote attacker could initiate a FaceTime call causing arbitrary code execution
- An application may be able to execute arbitrary code with kernel privileges
- An application may be able to read restricted memory
- Processing a maliciously crafted text message may lead to UI spoofing
- An attacker in a privileged position may be able to perform a denial of service attack
- Connecting to a VPN server may leak DNS queries to a DNS proxy
- Processing a maliciously crafted vcf file may lead to a denial of service
Apple has acknowledged a number of security researchers and white hat hackers for identifying and reporting the security vulnerabilities. Google Project Zero maintains its usual presence with quite a list of issues being reported by them, along with Trend Micro, Pangu Team, Mohamed Ghannam (@_simo36), Rayyan Bijoora (@Bijoora), Ryan Pickren, and others.
The latest iOS 12.1 is now available for iPhone 5s and later, iPad Air and later, and iPod touch 6th generation. Here is every security issue that iOS 12.1 promises to fix.
Security content of iOS 12.1 – complete changelog
AppleAVD
Impact: Processing malicious video via FaceTime may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
CVE-2018-4384: Natalie Silvanovich of Google Project Zero
Contacts
Impact: Processing a maliciously crafted vcf file may lead to a denial of service
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2018-4365: an anonymous researcher
CoreCrypto
Impact: An attacker may be able to exploit a weakness in the Miller-Rabin primality test to incorrectly identify prime numbers
Description: An issue existed in the method for determining prime numbers. This issue was addressed by using pseudorandom bases for testing of primes.
CVE-2018-4398: Martin Albrecht, Jake Massimo and Kenny Paterson of Royal Holloway, University of London, and Juraj Somorovsky of Ruhr University, Bochum
FaceTime
Impact: A remote attacker may be able to leak memory
Description: A memory corruption issue was addressed with improved input validation.
CVE-2018-4366: Natalie Silvanovich of Google Project Zero
FaceTime
Impact: A remote attacker may be able to initiate a FaceTime call causing arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
CVE-2018-4367: Natalie Silvanovich of Google Project Zero
Graphics Driver
Impact: A remote attacker may be able to initiate a FaceTime call causing arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
CVE-2018-4384: Natalie Silvanovich of Google Project Zero
ICU
Impact: Processing a maliciously crafted string may lead to heap corruption
Description: A memory corruption issue was addressed with improved input validation.
CVE-2018-4394: an anonymous researcher
IOHIDFamily
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2018-4427: Pangu Team
IPSec
Impact: An application may be able to gain elevated privileges
Description: An out-of-bounds read was addressed with improved input validation.
CVE-2018-4371: Tim Michaud (@TimGMichaud) of Leviathan Security Group
Kernel
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed by removing the vulnerable code.
CVE-2018-4420: Mohamed Ghannam (@_simo36)
Kernel
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed with improved memory handling.
CVE-2018-4413: Juwei Lin (@panicaII) of TrendMicro Mobile Security Team
Kernel
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2018-4419: Mohamed Ghannam (@_simo36)
Messages
Impact: Processing a maliciously crafted text message may lead to UI spoofing
Description: An inconsistent user interface issue was addressed with improved state management.
CVE-2018-4390: Rayyan Bijoora (@Bijoora) of The City School, PAF Chapter
CVE-2018-4391: Rayyan Bijoora (@Bijoora) of The City School, PAF Chapter
NetworkExtension
Impact: Connecting to a VPN server may leak DNS queries to a DNS proxy
Description: A logic issue was addressed with improved state management.
CVE-2018-4369: an anonymous researcher
Notes
Impact: A local attacker may be able to share items from the lock screen
Description: A lock screen issue allowed access to the share function on a locked device. This issue was addressed by restricting options offered on a locked device.
CVE-2018-4388: videosdebarraquito
Safari Reader
Impact: Enabling the Safari Reader feature on a maliciously crafted webpage may lead to universal cross site scripting
Description: A logic issue was addressed with improved validation.
CVE-2018-4374: Ryan Pickren (ryanpickren.com)
Safari Reader
Impact: Enabling the Safari Reader feature on a maliciously crafted webpage may lead to universal cross site scripting
Description: A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation.
CVE-2018-4377: Ryan Pickren (ryanpickren.com)
Security
Impact: Processing a maliciously crafted S/MIME signed message may lead to a denial of service
Description: A validation issue was addressed with improved logic.
CVE-2018-4400: Yukinobu Nagayasu of LAC Co., Ltd.
VoiceOver
Impact: A local attacker may be able to view photos from the lock screen
Description: A lock screen issue allowed access to photos via Reply With Message on a locked device. This issue was addressed with improved state management.
CVE-2018-4387: videosdebarraquito
WebKit
Impact: Visiting a malicious website may lead to address bar spoofing
Description: A logic issue was addressed with improved state management.
CVE-2018-4385: an anonymous researcher
WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
CVE-2018-4372: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea
CVE-2018-4373: ngg, alippai, DirtYiCE, KT of Tresorit working with Trend Micro’s Zero Day Initiative
CVE-2018-4375: Yu Haiwan and Wu Hongjun From Nanyang Technological University working with Trend Micro’s Zero Day Initiative
CVE-2018-4376: 010 working with Trend Micro’s Zero Day Initiative
CVE-2018-4382: lokihardt of Google Project Zero
CVE-2018-4386: lokihardt of Google Project Zero
CVE-2018-4392: zhunki of 360 ESG Codesafe Team
CVE-2018-4416: lokihardt of Google Project Zero
WebKit
Impact: A malicious website may be able to cause a denial of service
Description: A resource exhaustion issue was addressed with improved input validation.
CVE-2018-4409: Sabri Haddouche (@pwnsdx) of Wire Swiss GmbH
WebKit
Impact: Processing maliciously crafted web content may lead to code execution
Description: A memory corruption issue was addressed with improved validation.
CVE-2018-4378: an anonymous researcher, zhunki of 360 ESG Codesafe Team
WiFi
Impact: An attacker in a privileged position may be able to perform a denial of service attack
Description: A denial of service issue was addressed with improved validation.
CVE-2018-4368: Milan Stute and Alex Mariotto of Secure Mobile Networking Lab at Technische Universität Darmstadt
