Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.2860
APPLE-SA-2018-9-24-4 iOS 12
25 September 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Apple iOS
Publisher: Apple
Operating System: Apple iOS
Impact/Access: Root Compromise -- Remote with User Interaction
Access Privileged Data -- Remote/Unauthenticated
Execute Arbitrary Code/Commands -- Remote with User Interaction
Cross-site Scripting -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Provide Misleading Information -- Remote with User Interaction
Unauthorised Access -- Existing Account
Reduced Security -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2018-5383 CVE-2018-4363 CVE-2018-4362
CVE-2018-4361 CVE-2018-4359 CVE-2018-4358
CVE-2018-4356 CVE-2018-4352 CVE-2018-4345
CVE-2018-4344 CVE-2018-4338 CVE-2018-4336
CVE-2018-4335 CVE-2018-4333 CVE-2018-4329
CVE-2018-4328 CVE-2018-4325 CVE-2018-4323
CVE-2018-4322 CVE-2018-4321 CVE-2018-4319
CVE-2018-4318 CVE-2018-4317 CVE-2018-4316
CVE-2018-4315 CVE-2018-4314 CVE-2018-4313
CVE-2018-4312 CVE-2018-4311 CVE-2018-4309
CVE-2018-4307 CVE-2018-4306 CVE-2018-4305
CVE-2018-4299 CVE-2018-4197 CVE-2018-4191
CVE-2016-1777
Reference: ASB-2018.0190
ASB-2018.0184
ESB-2018.1656.2
ESB-2018.1655.2
ESB-2016.2961
ESB-2016.0748
Original Bulletin:
https://support.apple.com/en-au/HT209106
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-9-24-4 iOS 12
iOS 12 addresses the following:
Accounts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local app may be able to read a persistent account
identifier
Description: This issue was addressed with improved entitlements.
CVE-2018-4322: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Auto Unlock
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to access local users
AppleIDs
Description: A validation issue existed in the entitlement
verification. This issue was addressed with improved validation of
the process entitlement.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Bluetooth
Available for: iPhone SE, iPhone 6s, iPhone 6s Plus, iPhone 7,
iPhone 7 Plus, iPad Mini 4, 12.9-inch iPad Pro 1st generation,
12.9-inch iPad Pro 2nd generation, 10.5-inch iPad Pro,
9.7-inch iPad Pro, iPad 5th generation, and iPod Touch 6th generation
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth. This
issue was addressed with improved input validation.
CVE-2018-5383: Lior Neumann and Eli Biham
CoreMedia
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An app may be able to learn information about the current
camera view before being granted camera access
Description: A permissions issue existed. This issue was addressed
with improved permission validation.
CVE-2018-4356: an anonymous researcher
Crash Reporter
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4333: Brandon Azad
IOMobileFrameBuffer
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4335: Brandon Azad
iTunes Store
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel. This
issue was addressed with improved input validation.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted
messages
Description: A consistency issue existed in the handling of
application snapshots. The issue was addressed with improved handling
of message deletions.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MürÅ\x{159}ide Ã\x{150}zünenek Anadolu Lisesi -
Ankara/Türkiye, Mehmet Ferit DaÅ\x{159}tan of Van Yüzüncü Yıl
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Notes
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted notes
Description: A consistency issue existed in the handling of
application snapshots. The issue was addressed with improved handling
of notes deletions.
CVE-2018-4352: an anonymous researcher
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots. The issue was addressed with improved handling
of application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MürÅ\x{159}ide Ã\x{150}zünenek Anadolu Lisesi -
Ankara/Türkiye, Mehmet Ferit DaÅ\x{159}tan of Van Yüzüncü Yıl
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A user may be unable to delete browsing history items
Description: Clearing a history item may not clear visits with
redirect chains. The issue was addressed with improved data deletion.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)
SafariViewController
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2018-4362: Jun Kokatsu (@shhnjk)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to exfiltrate autofilled data
in Safari
Description: A logic issue was addressed with improved state
management.
CVE-2018-4307: Rafay Baloch of Pakistan Telecommunications Authority
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Status Bar
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
determine the last used app from the lock screen
Description: A logic issue was addressed with improved restrictions.
CVE-2018-4325: Brian Adeloye
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4316: crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel Groβ (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4323: Ivan Fratric of Google Project Zero
CVE-2018-4328: Ivan Fratric of Google Project Zero
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroÃ\x{159} (@5aelo)
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
This was addressed with improved tracking of security origins.
CVE-2018-4319: John Pettitt of Google
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4197: Ivan Fratric of Google Project Zero
CVE-2018-4306: Ivan Fratric of Google Project Zero
CVE-2018-4312: Ivan Fratric of Google Project Zero
CVE-2018-4314: Ivan Fratric of Google Project Zero
CVE-2018-4315: Ivan Fratric of Google Project Zero
CVE-2018-4317: Ivan Fratric of Google Project Zero
CVE-2018-4318: Ivan Fratric of Google Project Zero
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may exfiltrate image data cross-origin
Description: A cross-site scripting issue existed in Safari. This
issue was addressed with improved URL validation.
CVE-2018-4345: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to execute scripts in the
context of another website
Description: A cross-site scripting issue existed in Safari. This
issue was addressed with improved URL validation.
CVE-2018-4309: an anonymous researcher working with Trend Micro's
Zero Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by Google OSS-Fuzz
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4338: Lee @ SECLAB, Yonsei University working with Trend
Micro's Zero Day Initiative
Additional recognition
Assets
We would like to acknowledge Brandon Azad for their assistance.
configd
We would like to acknowledge Sabri Haddouche (@pwnsdx) of Wire Swiss
GmbH for their assistance.
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Exchange ActiveSync
We would like to acknowledge Jesse Thompson of University of
Wisconsin-Madison for their assistance.
Feedback Assistant
We would like to acknowledge Marco Grassi (@marcograss) of KeenLab
(@keen_lab) Tencent working with Trend Micro's Zero Day Initiative
for their assistance.
Mail
We would like to acknowledge Alessandro Avagliano of Rocket Internet
SE, Gunnar Diepenbruck, and Zbyszek ŻóÅ\x{130}kiewski for their
assistance.
MediaRemote
We would like to acknowledge Brandon Azad for their assistance.
Safari
We would like to acknowledge Marcel Manz of SIMM-Comm GmbH and Vlad
Galbin for their assistance.
Sandbox Profiles
We would like to acknowledge Tencent Keen Security Lab working with
Trend Micro's Zero Day Initiative for their assistance.
Security
We would like to acknowledge Christoph Sinai, Daniel Dudek
(@dannysapples) of The Irish Times and Filip KlubiÄ\x{141}ka (@lemoncloak)
of ADAPT Centre, Dublin Institute of Technology, Istvan Csanady of
Shapr3D, Omar Barkawi of ITG Software, Inc., Phil Caleno, Wilson
Ding, and an anonymous researcher for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Status Bar
We would like to acknowledge Ju Zhu of Meituan and Moony Li and
Lilang Wu of Trend Micro for their assistance.
WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, Tencent Keen Security Lab working with Trend Micro's
Zero Day Initiative, and Zach Malone of CA Technologies for their
assistance.
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 12".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlupKN8ACgkQeC9tht7T
K3HRjhAAmOsVGWrsRrLkWEJannDcf9kXlqcuncCFCR9y611KX0TEYrzc5SAvNov9
CIHNL4lAzX2LhyWml0kwTDBjODYxOGb40lZN2cg/vyLrLSwkjV0tv6ITe9+UR5ov
6RohJ2ldHYnTnrj0752/GlSO28PICgXdNIDrnhDCVh6I3Zea25GpDai7RSNQ6Gf4
470OCB1euLNNGZs9M6jgnF7RTPf5oxUulFweOgzvboIyvDYn3F8K9agN1/ZwtHAx
rYeEXDFj01qk7IzuUXWX7tpArOMhTzLbgRTjIiuovXIRX9bnQ7eMeGspLvHyGwk+
h6VBfRFq+j4Fa7suqFTx86XToHXzMvLJHaExnOeRd0Dn6aHpAaDFkWKHwGKis0ff
pdmHlKtlOqSrk/8K4Capjzet4cTFIYl4k/ufpebVYxyOfJSFzTK0wk8wg+/MY1Dc
+7RdH/t7hhtmCQW0vIE9H0BS3g73XTUbmaGABUWFrHtB0f6AjpyUMCjjcijoIoiW
WkPHg3z/MnsNB9nxGTK8Wyk8bC2hp/mCi9BuHeHvJW4XeNvdv3xJC4PEKKjqwTFE
zWiku93QGhKTbsVfMiIXbSTCSi+iIgieNZikF2ChnmZeY15h3b7dxksRSd35qKha
flFZRpIEx3yruMdntHiy4yyg8vcyJw7pT7sz16tp/RomQjbl7iI=
=tmPh
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW6mF72aOgq3Tt24GAQh+Fw/9HttZjCoLVkDX9r6yoHFqmp9196MIoVHa
qYVKbifmjCROXugVB0aclRQ4ygin7tFhzsa9ptf0UAVrnTr9BsNxCqgnBt4lMryJ
b4gsQg9ulIdSf7d2pQMibb6mnvpyYawaxKwz19UQXE4uuo3ANjESJN35V6/U92KL
LvS+UA+hzryr8ND3kQeLe+bKAVq6ryo7RreJm0gjc2ctxpFF78guAuyhP5F4ljKJ
U7UgucdkzFousPHTmqSdZJ2hz09VIbZ4fW7ZT3R2cDQuchWEwwVxK9tcDhXs8GYT
7MMTWpq0wuuBbD/GD6D3x/qUVos9J9ezBVuM4xrdIJYP5c74dDuRYORd0kTkC78y
uuacCAEwtq65YVPblYFhqEMLnYh99hqGncbY0Ya0Ia8IBEPextfANwRkhCCqkNJL
teTF71Qkg0d2ZgDoc2dokgXab0bra5nA/vTKwlJbV1SFymwsl7MZ4c4p8PQCKeQY
GpWLSYQW4csLDwpQo+6G4yvVo3ICM0NYDp2WQ9EAL1mQCA/fMkULWZh+paBpJuUw
Nrry4xq+jP+xPaTSEJgX4itFilhcxTyXI6tM96JaQBFMp1xVgD67U/RAglSZVjky
qR4FEIOB0/HWy310mOUxqX6U3Dj2Dh6/IMDq75X8CW1O4UzU6ZNYPmbGN0mTNMTN
cTge+bITHYs=
=Mpqb
-----END PGP SIGNATURE-----