Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.2861
APPLE-SA-2018-9-24-5 watchOS 5
25 September 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Apple watchOS
Publisher: Apple
Operating System: Mobile Device
Impact/Access: Root Compromise -- Remote with User Interaction
Access Privileged Data -- Remote/Unauthenticated
Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Provide Misleading Information -- Remote with User Interaction
Access Confidential Data -- Existing Account
Reduced Security -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2018-4363 CVE-2018-4361 CVE-2018-4359
CVE-2018-4358 CVE-2018-4344 CVE-2018-4336
CVE-2018-4319 CVE-2018-4313 CVE-2018-4311
CVE-2018-4305 CVE-2018-4299 CVE-2018-4191
CVE-2016-1777
Reference: ESB-2018.2858
ESB-2018.2857
ESB-2018.2780
ESB-2016.2961
ESB-2016.0748
Original Bulletin:
https://support.apple.com/en-au/HT209108
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-9-24-5 watchOS 5
watchOS 5 addresses the following:
iTunes Store
Available for: Apple Watch Series 1 and later
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: Apple Watch Series 1 and later
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel. This
issue was addressed with improved input validation.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
Safari
Available for: Apple Watch Series 1 and later
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots. The issue was addressed with improved handling
of application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MürÅ\x{159}ide Ã\x{150}zünenek Anadolu Lisesi -
Ankara/Türkiye, Mehmet Ferit DaÅ\x{159}tan of Van Yüzüncü Yıl
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Security
Available for: Apple Watch Series 1 and later
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
WebKit
Available for: Apple Watch Series 1 and later
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
WebKit
Available for: Apple Watch Series 1 and later
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)
WebKit
Available for: Apple Watch Series 1 and later
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel Groβ (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroÃ\x{159} (@5aelo)
WebKit
Available for: Apple Watch Series 1 and later
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
This was addressed with improved tracking of security origins.
CVE-2018-4319: John Pettitt of Google
WebKit
Available for: Apple Watch Series 1 and later
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by Google OSS-Fuzz
Additional recognition
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Sandbox Profiles
We would like to acknowledge Tencent Keen Security Lab working with
Trend Micro's Zero Day Initiative for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
WebKit
We would like to acknowledge Tencent Keen Security Lab working with
Trend Micro's Zero Day Initiative for their assistance.
Installation note:
Instructions on how to update your Apple Watch software are
available at https://support.apple.com/kb/HT204641
To check the version on your Apple Watch, open the Apple Watch app
on your iPhone and select "My Watch > General > About".
Alternatively, on your watch, select "My Watch > General > About".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlupKN8ACgkQeC9tht7T
K3HXyQ/+MflW2OCKpPk8DF7N1cADRoRVaxhYepVD/fVAD6rdxZmzSjXE9MeQYPQu
/Deo1C9oOGVvRifh90BTSgSZ2Pmg77L1uoSqaiuUVKiSq0ApTJog+3A2zGcyO94/
ge0iV3vP2edDh2kFrs6ucOaRuZhUwZ13ziUwWNQboop5I8tj/bOBH9ubs6sabkq8
vS9Yi/LU3yqXczRiw56GtRjwdDrn1E52O0jXh8SysRcGcQsckYYdHK5fSiP7+tK0
NqlBDAmL6UATwW5DmGK0/Yuf95jMAIhsM4N+weWbpHI1nrL1X6w41yti3mGNts1A
8i3JTBCShD+AzgIi01oB32SOa02e5rXEz5oWO7YWPexJ8mfKKjv5kPnBijidfYzU
gRmwdxVyKSkgfppJip+rTm3xMfJMAOLpb5TWTohuHKEGhA/C5SQ76dbwJCJj3hzt
ONX5suPp+CM4tvxDLfeuoF91vUHoP+Hd3+7zU2VF7bp6utLv4Asma7wX147VShgS
RW2fRHEH4M+c3ip6CpkVlXaQO70xurFXem7AuwNffv9uUT039pPy46xO8lyyg48w
fjOWBwABFVk6uyzYRuiOJ6qegw5mngHOoT4wncygl3Y4BxbBBuZi5gRIxNQutWeA
wbfBeM6ckH8mgKu3YlL6tzAYoVuGmC/q/frQCHjxJ/KvSSXf7yQ=
=j6pw
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW6mF/GaOgq3Tt24GAQgiTg/+PnD0YQWHbWYZE6fGlnKNmQ76KQOyl7YQ
HU2O3k9n9DkszBMKcRxV7yRM8N56LwEhCbvmOUZ8D+fyiXjp9JBy0QRnaI2SMMlE
IBI9kBw4E5Be0Cl5ZuiDJNUEVDZjYr2u22nn1k5joD0dDO8iSjRADOOIwQVjbpRo
BmZ5vXreRME3FOby6v/XRR3JlhTuTUk1psRXueQ8RY3kJroys4wYL3vHD9zttNz4
vHIpVOXsr95lbMjW7gNPM9nFdfuGIHqm/HAaDkLV3ggQADHupCFegIqIWppSbN27
Xv/BwN5eZZZ+qjdqat4d4GBJmGNbw39qexpcIcPWcrAyIBt+FeAZhjwTrlJPszq+
GWTlOT7GFhCAjnYfwJmcQI3kgB3Xq7T7St4ycUG0QplJwZAS26lCqtREQqBL+cFY
8CL3zr+VonITo3XonkdtuNKA0D+zuwLNHgTXkwM2xq3nRGyG81Sbh/65EjWRuN/8
t1ogEw5/qG3EgnThnwYhYrCw6/NqYn3jV3S6HGuQPtMP+3m3yMqWFq/yIw/fcqQL
J4iSiuSZt8Lllvbl2VFQrEIuzP/cO/kylWrrET/2UOoRPklUYzTQWRMsCbMAf1FY
DpsF7Dgyzy9+MRdjdUSXWTfnPK2AZy91P9iJlNSPBPgQpf/b20cwT/9Di3inzabH
SlnyS0LW0HQ=
=1bey
-----END PGP SIGNATURE-----