5 New Apple Security Updates [17-09-2018]
Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system.
Apple Support 2.4 for iOS – iOS 11.0 and later – Released 17th September 2018
Safari 12 – macOS Sierra 10.12.6, macOS High Sierra 10.13.617 – Released 17th September 2018
watchOS 5 -Apple Watch Series 1 and later – Released 17th September 2018
tvOS 12 – Apple TV 4K and Apple TV (4th generation) – Released 17th September 2018
iOS 12 – iPhone 5s and later, iPad Air and later, and iPod touch 6th generation – Released 17th September 2018
Apple Support 2.4 for iOS
Released September 17, 2018
Analytics
Available for: iOS 11.0 and later
Impact: An attacker in a privileged network position may be able to intercept analytics data sent to Apple
Description: Analytics data was sent using HTTP rather than HTTPS. This was addressed by sending analytics data using HTTPS.
CVE-2018-4397: Yiğit Can YILMAZ (@yilmazcanyigit)
Safari 12
Released September 17, 2018
Safari
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: A malicious website may be able to exfiltrate autofilled data in Safari
Description: A logic issue was addressed with improved state management.
CVE-2018-4307: Rafay Baloch of Pakistan Telecommunications Authority
Safari
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: A user may be unable to delete browsing history items
Description: Clearing a history item may not clear visits with redirect chains. The issue was addressed with improved data deletion.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)
Safari
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: Visiting a malicious website by clicking a link may lead to user interface spoofing
Description: An inconsistent user interface issue was addressed with improved state management.
CVE-2018-4195: xisigr of Tencent’s Xuanwu Lab (www.tencent.com)
watchOS 5
Released September 17, 2018
iTunes Store
Available for: Apple Watch Series 1 and later
Impact: An attacker in a privileged network position may be able to spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: Apple Watch Series 1 and later
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel. This issue was addressed with improved input validation.
CVE-2018-4363: Ian Beer of Google Project Zero
Safari
Available for: Apple Watch Series 1 and later
Impact: A local user may be able to discover websites a user has visited
Description: A consistency issue existed in the handling of application snapshots. The issue was addressed with improved handling of application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert Ulu of Abdullah Mürşide Özünenek Anadolu Lisesi – Ankara/Türkiye, Mehmet Ferit Daştan of Van Yüzüncü Yıl University, Metin Altug Karakaya of Kaliptus Medical Organization, Vinodh Swami of Western Governor’s University (WGU)
Security
Available for: Apple Watch Series 1 and later
Impact: An attacker may be able to exploit weaknesses in the RC4 cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
tvOS 12
Released September 17, 2018
Bluetooth
Available for: Apple TV (4th generation)
Impact: An attacker in a privileged network position may be able to intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth. This issue was addressed with improved input validation.
CVE-2018-5383: Lior Neumann and Eli Biham
iTunes Store
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: An attacker in a privileged network position may be able to spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel. This issue was addressed with improved input validation.
CVE-2018-4363: Ian Beer of Google Project Zero
Safari
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: A local user may be able to discover websites a user has visited
Description: A consistency issue existed in the handling of application snapshots. The issue was addressed with improved handling of application snapshots.
CVE-2018-4313: an anonymous researcher, an anonymous researcher, an anonymous researcher, an anonymous researcher, an anonymous researcher, an anonymous researcher, an anonymous researcher, an anonymous researcher, an anonymous researcher, an anonymous researcher, an anonymous researcher, David Scott, Enes Mert Ulu of Abdullah Mürşide Özünenek Anadolu Lisesi – Ankara/Türkiye, Mehmet Ferit Daştan of Van Yüzüncü Yıl University, Metin Altug Karakaya of Kaliptus Medical Organization, Vinodh Swami of Western Governor’s University (WGU)
Security
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: An attacker may be able to exploit weaknesses in the RC4 cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
iOS 12
Released September 17, 2018
Accounts
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A local app may be able to read a persistent account identifier
Description: This issue was addressed with improved entitlements.
CVE-2018-4322: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Bluetooth
Available for: iPhone SE, iPhone 6s, iPhone 6s Plus, iPhone 7, iPhone 7 Plus, iPad Mini 4, 12.9-inch iPad Pro 1st generation, 12.9-inch iPad Pro 2nd generation, 10.5-inch iPad Pro, 9.7-inch iPad Pro, iPad 5th generation, and iPod Touch 6th generation
Impact: An attacker in a privileged network position may be able to intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth. This issue was addressed with improved input validation.
CVE-2018-5383: Lior Neumann and Eli Biham
Core Bluetooth
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2018-4330: Apple
CoreMedia
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: An app may be able to learn information about the current camera view before being granted camera access
Description: A permissions issue existed. This issue was addressed with improved permission validation.
CVE-2018-4356: an anonymous researcher
IOMobileFrameBuffer
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
CVE-2018-4335: Brandon Azad
iTunes Store
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: An attacker in a privileged network position may be able to spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel. This issue was addressed with improved input validation.
CVE-2018-4363: Ian Beer of Google Project Zero
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A local user may be able to discover a user’s deleted messages
Description: A consistency issue existed in the handling of application snapshots. The issue was addressed with improved handling of message deletions.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert Ulu of Abdullah Mürşide Özünenek Anadolu Lisesi – Ankara/Türkiye, Mehmet Ferit Daştan of Van Yüzüncü Yıl University, Metin Altug Karakaya of Kaliptus Medical Organization, Vinodh Swami of Western Governor’s University (WGU)
Notes
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A local user may be able to discover a user’s deleted notes
Description: A consistency issue existed in the handling of application snapshots. The issue was addressed with improved handling of notes deletions.
CVE-2018-4352: an anonymous researcher
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A local user may be able to discover websites a user has visited
Description: A consistency issue existed in the handling of application snapshots. The issue was addressed with improved handling of application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert Ulu of Abdullah Mürşide Özünenek Anadolu Lisesi – Ankara/Türkiye, Mehmet Ferit Daştan of Van Yüzüncü Yıl University, Metin Altug Karakaya of Kaliptus Medical Organization, Vinodh Swami of Western Governor’s University (WGU)
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A user may be unable to delete browsing history items
Description: Clearing a history item may not clear visits with redirect chains. The issue was addressed with improved data deletion.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A malicious website may be able to exfiltrate autofilled data in Safari
Description: A logic issue was addressed with improved state management.
CVE-2018-4307: Rafay Baloch of Pakistan Telecommunications Authority
SafariViewController
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with improved state management.
CVE-2018-4362: Jun Kokatsu (@shhnjk)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: An attacker may be able to exploit weaknesses in the RC4 cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Status Bar
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A person with physical access to an iOS device may be able to determine the last used app from the lock screen
Description: A logic issue was addressed with improved restrictions.
CVE-2018-4325: Brian Adeloye
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
CVE-2018-4338: Lee @ SECLAB, Yonsei University working with Trend Micro’s Zero Day Initiative
Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.