ESB-2018.1988 - [tvOS] Apple tvOS: Multiple vulnerabilities 2018-07-10
Printable versionPGP/GPG verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.1988
tvOS 11.4.1 released
10 July 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Apple tvOS
Publisher: Apple
Operating System: Apple iOS
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Increased Privileges -- Existing Account
Access Privileged Data -- Existing Account
Denial of Service -- Remote with User Interaction
Provide Misleading Information -- Remote with User Interaction
Reduced Security -- Unknown/Unspecified
Resolution: Patch/Upgrade
CVE Names: CVE-2018-4293 CVE-2018-4284 CVE-2018-4282
CVE-2018-4280 CVE-2018-4278 CVE-2018-4277
CVE-2018-4273 CVE-2018-4272 CVE-2018-4271
CVE-2018-4270 CVE-2018-4267 CVE-2018-4266
CVE-2018-4265 CVE-2018-4264 CVE-2018-4263
CVE-2018-4262 CVE-2018-4261 CVE-2018-4248
Reference: ESB-2018.1985
Original Bulletin:
https://support.apple.com/en-au/HT208936
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-7-9-3 tvOS 11.4.1
tvOS 11.4.1 is now available and addresses the following:
CFNetwork
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Cookies may unexpectedly persist in Safari
Description: A cookie management issue was addressed with improved
checks.
CVE-2018-4293: an anonymous researcher
Kernel
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: A local user may be able to read kernel memory
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed with improved input
validation.
CVE-2018-4282: Proteas of Qihoo 360 Nirvan Team
libxpc
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4280: Brandon Azad
libxpc
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: A malicious application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2018-4248: Brandon Azad
LinkPresentation
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Visiting a malicious website may lead to address bar spoofing
Description: A spoofing issue existed in the handling of URLs. This
issue was addressed with improved input validation.
CVE-2018-4277: xisigr of Tencent's Xuanwu Lab (tencent.com)
WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4270: found by OSS-Fuzz
WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: A malicious website may exfiltrate audio data cross-origin
Description: Sound fetched through audio elements may be exfiltrated
cross-origin. This issue was addressed with improved audio taint
tracking.
CVE-2018-4278: Jun Kokatsu (@shhnjk)
WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2018-4284: Found by OSS-Fuzz
WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: A malicious website may be able to cause a denial of service
Description: A race condition was addressed with additional
validation.
CVE-2018-4266: found by OSS-Fuzz
WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4261: Omair working with Trend Micro's Zero Day Initiative
CVE-2018-4262: Mateusz Krzywicki working with Trend Micro's Zero Day
Initiative
CVE-2018-4263: Arayz working with Trend Micro's Zero Day Initiative
CVE-2018-4264: found by OSS-Fuzz, Yu Zhou and Jundong Xie of
Ant-financial Light-Year Security Lab
CVE-2018-4265: cc working with Trend Micro's Zero Day Initiative
CVE-2018-4267: Arayz of Pangu team working with Trend Micro's Zero
Day Initiative
CVE-2018-4272: found by OSS-Fuzz
WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: Multiple memory corruption issues were addressed with
improved input validation.
CVE-2018-4271: found by OSS-Fuzz
CVE-2018-4273: found by OSS-Fuzz
Additional recognition
Kernel
We would like to acknowledge juwei lin (@panicaII) of Trend Micro
working with Trend Micro's Zero Day Initiative for their
assistance.
Installation note:
Apple TV will periodically check for software updates. Alternatively,
you may manually check for software updates by selecting
"Settings -> System -> Software Update -> Update Software."
To check the current version of software, select
"Settings -> General -> About."
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
- -----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEfcwwPWJ3e0Ig26mf8ecVjteJiCYFAltDyFIpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQ8ecVjteJiCbGSQ/9
EB9rnBmzuhPOQBY4qZpl6x9iIDvIHFGDYpZ5e1KqAMJ50wcA6JdaZCZerq+XRKga
YnR5TmXVhOGI+gMu5gmMMOrqu43O3uXVAVVfqItHDOnt4fLZVcHsVkjr+19Ue+nY
24SRIKWDVldqjrhJX0YyJ1V/UGbwodK5B5qm7ZMcJMMwNB8pII8MnIIx513Xv7Qx
5pSrerwraCOhZkHOQ5jMSex2qniLGdtLwEaLfCCYEgRJHB44U1SDtYKGzHvWkPeN
vEFf7YOz58ejjsP6flYFKPdCXtLHhK1BXeXPEl2zN7ghef/6KVhljx84lJExhGDz
WRfep8HpK3QraFqhW2M7lMBCl7oz8H25M7QAniQ5RQRG3jiM/xBZ9O3RRNJG43uJ
gZ7M0QUHE6fTvfMa/XKAj93gisRhyZdSZPLN6o3cekyxjdVPAFGUXF6cuT8pq87/
bD4Sf1JhbcMYNiAY6kVf+UCSubB5aGTwg4e8fvvDmeTImU9bwtdvd3NWPkDSH7U+
I/FMlfEUd4dALCOQK/xEVIo00+6dNm40H2BSmjTecNsxmPcl+sUrcrj4VQqi9n26
H3OuRay6A8q+W1y/7a+pGR8ZUGY2Sd3aCl295J6S0iTWxOopefpYGltv7HUgXHSD
wrLvX91VWNttVXlBShHP8ItcgFnjsGnisjP3XGfAFgI=
=fxoF
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW0P3XWaOgq3Tt24GAQiikRAAgFBnQ6KBsMQxJtPH8z9LCIOlqG1G6Oer
kaGY1EZQS1RXw8YsdiHLkOHWYWLEOdOg8AFu06VnVNwqJOyngcLOuCn1wJdPAQQU
KbcJIoCys7GmATCcJ51niMRxPejTlGWRupy2TQVDY/RRhlUEfjgS0ZtWU6jHfkPW
Svyd3aQ5cI1hqeqPrveLsiudM88TgqIqWYoW1UWFYB+/2162tgGhnr4xD9Zaes1Y
tFH/V3s3Dg5+f+bcaQ85cLQbmvXg/bx1rizk+pDOuNAlqmr71Wx28lUGnUEvFyYq
VnYlzjpnjCTHwJtyCQmdrZhHn7gABE6j4DoSeFcs9NSCQosxiZ2L4tMXTIOUitcR
9RqFs4mc8F4bNK9hlIyYBfQ4tljKjJ57ftYDDfUppp7XOdzpxMWoa29SyXt51ORk
Jd/OhbNLBScUKboNhbJIyxIH7Wa2cASsXBlQIfjpNYGuWLtSO/U3qbk5N+WmM6Kb
ZFLM7oOpAEqDHAE/xr11iYtbTvJSxs98kpVD5tW2zonS7629tjmoeu2XRO21zYtd
f+TKm+KUhHyZA/cX2sKywKox5ouHsGZXlYmad+AJkFhojjnt1/jsnc1jffKXIO5p
gAqA+fk3xRb3v4Ote/Wp8eC9CLI9N4ZFyXAvNTLLNWW5h7QVrksTRbWbeSJrh9o4
B2/9dtbXPsE=
=z7y5
-----END PGP SIGNATURE-----
« Back to bulletins