Les mises à jour de sécurité Apple iOS 12.1.3 corrigent de multiples vulnérabilités
Apple has released iOS 12.1.3 to fix 31 CVEs including a FaceTime remote code execution vulnerability
Contexte
On January 22, Apple released iOS 12.1.3, which includes fixes for 31 different CVEs across multiple apps and services. This update also includes fixes for CVE-2019-6227 and CVE-2019-6225, which security researcher Qixun Zhao of Qihoo 360 Vulcan Team reportedly used in a code execution attack through FaceTime. The attack requires a user to tap on a malicious link, which could be achieved through social engineering.
Analyse
An attacker could craft a malicious FaceTime link that, when clicked, exploits a kernel bug in iOS allowing the attacker to jailbreak the targeted iOS device. The attacker can then make use of the jailbroken device to remotely take control as a root user.
Social engineering attacks increased in 2018, and with smartphones playing a major part in business, device security is paramount to organizational security. If employees in your organization connect to a corporate network over wifi, or charge their personal devices on their work device USB ports, we recommend encouraging your employees to be as diligent about their personal device updates as the CISO is about corporate assets.
Démonstration de faisabilité (PoC)
Qihoo 360 created a proof of concept (PoC) video demonstrating the attack.
Solution
Upgrade iOS devices to version 12.1.3
Identification des systèmes affectés
Tenable Mobile Device Management (MDM) integration can identify mobile devices that are missing vendor updates. A list of our MDM plugins for this update can be found here as they’re released.
Où trouver plus d'informations
- Apple Security Information Page for iOS 12.1.3
- 360 Core Security Research Write Up
- CVE-2019-6227
- CVE-2019-6225
- Nessus Plugin List
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.
Articles connexes
Spotlight on Japan: Digital Transformation Initiatives Heighten Risk Levels
October 18, 2021As Japanese organizations roll out digital transformation initiatives and expand remote workforces, security teams need to address new risks in the new world of work. The rapid transition to remote w...
Spotlight on Brazil: Remote Work Requires New Risk Management Practices
October 14, 2021Remote work is here to stay — along with the risks it introduces to Brazilian organizations, if not managed properly. Here's what you need to know. The pandemic forced many Brazilian organizations to...
Cybersecurity Awareness: Six Tips to Help Your Employees Be Cybersmart
October 7, 2021We believe it's time for a new approach to cyber awareness, one that borrows on the concept of the shared responsibility model common in cloud computing. Here's how we get there. How much considerati...
Tenable Bolsters Its Cloud Security Arsenal with Malware Detection
May 1, 2024Tenable Cloud Security is enhancing its capabilities with malware detection. Combined with its cutting-edge, agentless vulnerability-scanning technology, including its ability to detect anomalous behavior, this new capability makes Tenable Cloud Security a much more complete and effective solution. Read on to find out how.
Cybersecurity Snapshot: Latest MITRE ATT&CK Update Offers Security Insights on GenAI, Identity, Cloud and CI/CD
April 26, 2024Check out what’s new in Version 15 of the MITRE ATT&CK knowledge base of adversary tactics, techniques and procedures. Plus, learn the latest details about the Change Healthcare breach, including the massive scope of the data exfiltration. In addition, why AI cyberthreats aren’t impacting CISOs’ budgets. And much more!
CVE-2024-20353, CVE-2024-20359: Frequently Asked Questions About ArcaneDoor
April 25, 2024Frequently asked questions about CVE-2024-20353 and CVE-2024-20359, two vulnerabilities associated with “ArcaneDoor,” the espionage-related campaign targeting Cisco Adaptive Security Appliances.
- BYOD
- Vulnerability Management