ESB-2018.3768 - Apple tvOS: Multiple vulnerabilities 2018-12-06

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.3768
                                tvOS 12.1.1
                              6 December 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Apple tvOS
Publisher:         Apple
Operating System:  tvOS
Impact/Access:     Root Compromise                 -- Existing Account            
                   Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Denial of Service               -- Existing Account            
                   Provide Misleading Information  -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-4465 CVE-2018-4464 CVE-2018-4461
                   CVE-2018-4460 CVE-2018-4447 CVE-2018-4443
                   CVE-2018-4442 CVE-2018-4441 CVE-2018-4438
                   CVE-2018-4437 CVE-2018-4436 CVE-2018-4435
                   CVE-2018-4431 CVE-2018-4303 

Reference:         ESB-2018.3766

Original Bulletin: 
   https://support.apple.com/en-au/HT209342

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-2018-12-05-3 tvOS 12.1.1

tvOS 12.1.1 is now available and addresses the following:

Airport
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: A malicious application may be able to elevate privileges
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2018-4303: Mohamed Ghannam (@_simo36)

Disk Images
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4465: Pangu Team

Kernel
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: An attacker in a privileged position may be able to perform a
denial of service attack
Description: A denial of service issue was addressed by removing the
vulnerable code.
CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team

Kernel
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: A local user may be able to read kernel memory
Description: A memory initialization issue was addressed with
improved memory handling.
CVE-2018-4431:  An independent security researcher has reported this
vulnerability to Beyond Security's SecuriTeam Secure Disclosure
program

Kernel
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro
Mobile Security Team

Kernel
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: A malicious application may be able to elevate privileges
Description: A logic issue was addressed with improved restrictions.
CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII)
and Junzhi Lu of TrendMicro Mobile Security Team

Kernel
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4461: Ian Beer of Google Project Zero

Profiles
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: An untrusted configuration profile may be incorrectly
displayed as verified
Description: A certificate validation issue existed in configuration
profiles. This was addressed with additional checks.
CVE-2018-4436: James Seeley @Code4iOS, Joseph S. of Wyong High School

WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4437: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of
KAIST Softsec Lab, Korea
CVE-2018-4464: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of
KAIST Softsec Lab, Korea

WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4441: lokihardt of Google Project Zero
CVE-2018-4442: lokihardt of Google Project Zero
CVE-2018-4443: lokihardt of Google Project Zero

WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A logic issue existed resulting in memory corruption.
This was addressed with improved state management.
CVE-2018-4438: lokihardt of Google Project Zero

Additional recognition

Profiles
We would like to acknowledge Luke Deshotels, Jordan Beichler, and
William Enck of North Carolina State University; Costin Carabs and
Razvan Deaconescu of University POLITEHNICA of Bucharest for their
assistance.

Installation note:

Apple TV will periodically check for software updates. Alternatively,
you may manually check for software updates by selecting
"Settings -> System -> Software Update -> Update Software."

To check the current version of software, select
"Settings -> General -> About."

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
- -----BEGIN PGP SIGNATURE-----

iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzspHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3E9ZhAA
s9sqYRY+0wx0rIkgP4XRHDeZd79Are9cUX2hHjG5YQtvUl7+LHw4QKhOQG495snS
GCj8/CuerxaqYCyyM4N2+pc/RPCAs/riQ+cO8mLg+cxdMrI3bojS0VTygo1KJtPk
VWijWZeYp2IMVGT2zU+qT6iWbCJgfyibFF720ZIh8z4xQGz1GyO+qscrR/wqpWKm
hZeyZdE6WstSV0y5KQ/f9ZsPERxqKMIW690Imxw6CGIWonnK5tjdIxoldVNP+nxW
fvzA8YqX3SRHwQQodCf8Tvj34gLksj1Bk+yHJC+AIhuVHSNjzEkzYYvFqEt1Qzt6
6r15zdiLmJQCUXsMHi8U1hhihOS2xqNX+ttT1a4KDwzwsQDvu0RRLsZjjZFDu6Qw
NSrPU3ThST/725vqv8UcT2CFEnGQ7oylhOvtfp2pJUOZ0PxQyLvfeCiNl2snztom
83/GbWvr2BzuT1KSXDlF9jhNUX1dwyrfD0ZJ1zYZu4GsCPe6CTgNWLGILgsDXkz8
URWmLF1ekqgm4zWV2WupA3cL+9lvNZmSnyIt1iHziz1A1wnBPwk+kQ9uOFajW9un
F4vEP2NJSe0dEUHRfUw9W1zx+koDgkK7ikex/LIJzNQ3kMw86YNkjpF+AKob//Bh
iZE+4ZdJ7f865wOpOlgT2siMiLXf8DA8jBdEAYsCb4Q=
=xZzZ
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXAhm+GaOgq3Tt24GAQgCRQ//cTDTE3771CHsnXzH4nagBxqmVjJ8xqz4
ijyI6elKo74M5gAksGBA3vygRiTtzCCrZIXbDEV0gWeqTxJd1UGSkDxsSRY63bYU
pZ6PnV+dETF27jOVj3RYpMaeyYyEn2+5EeTHhwZ64LeBsLubCxM5XV2ZMJnEIYBo
WgEr8JkSvdeEMYvhaPUtPQWCz9fNhgLcqNr/uLnXzaVvig99vrDbJhvU/W8CJCkM
nwelpXaBxyyw0tyJ/qZRetJCsTqzOEnxhJshAtMV/IvqfQsWaBxId+9at8E4w0if
JQaZugPiPpfO/XaH+MN8K/o8WhiBWgRZvNzXDEPZx4iKKfci9Zxxd9s2V/4UyrdW
DfhlkTmvB7iYEOLVbgbs4/sD69VMOY9TTvWa5cxdg8dav3s/BYqfbtB5qIU6n7t5
xl6YI58JDMav+UKnuBzPGplpYx03UaQzf9sizVxKlsKvzXrcU70gkR6rjb4lnJCI
GE+KOGLUO/iWuS4VhsZ3NCYGU2y1FgWyI+QhigFr9tmHKA9//SSzem2gVRv/hgEU
QlTAxrglB2hlWW6TBk7hoMi8LcsOMWstRCXGeoy8/ileKPnv2kKb3QCqTWnuWb6e
K5D90GJedbgFLYpQzecqtrAPS4qkJUbrFPQAzxw0ikRG8By41NllB+voMHebBzRk
VawlED6bz2M=
=FIuN
-----END PGP SIGNATURE-----

« Back to bulletins