Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: Apple Updates Everything, Again - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Apple Updates Everything, Again

Apple Patch Summary

Apple released updates for all of its products. Noteworthy is the "Meltdown" patch for Siera (10.12) and El Capitan (10.11) only. Apple has released patches for this vulnerability for High Sierra (10.13) about a week ago. For iOS, CVE-2018-4100 fixes a vulnerability that was already abused in the wild as part of a DoS attack against iOS devices. As usual, the WebKit vulnerabilities are probably the most critical once as they can be exploited via Safari to execute arbitrary code. Full details from Apple can be found here. On ouir Slack channel, there was a report that the OS X patches may cause systems to fail if Carbon Black Response is installed. Please let us know if you are running this product and if you had issues.

Component CVE MacOS/OS X  iOS watchOS tvOS
Core Bluetooth CVE-2018-4095   X X X
Security CVE-2018-4086 X X X X
QuartzCore CVE-2018-4085 X X X X
curl CVE-2017-8817 X      
Audio CVE-2018-4094 X X X X
Kernel CVE-2017-5754 (Meltdown) X      
Kernel CVE-2018-4097 X      
LinkPresentation CVE-2018-4100 X X X  
Kernel CVE-2018-4090 X X X X
Core Bluetooth CVE-2018-4087   X X X
IOHIDFamily CVE-2018-4098 X      
WebKit CVE-2018-4088 X X X X
WebKit CVE-2018-4089 X X   X
Kernel CVE-2018-4082 X X X X
Wi-Fi CVE-2018-4084 X      
Kernel CVE-2018-4093 X X X X
Sandbox CVE-2018-4091 X      
Kernel CVE-2018-4092 X X X X
WebKit CVE-2018-4096 X X X X

 

MacOS 10.13.3

Component Impact Description CVE(s)
Audio Processing a maliciously crafted audio file may lead to arbitrary code execution A memory corruption issue was addressed through improved input validation. CVE-2018-4094
Core Bluetooth An application may be able to execute arbitrary code with system privileges A memory corruption issue was addressed with improved memory handling. CVE-2018-4087,CVE-2018-4095
Kernel An application may be able to read restricted memory A memory initialization issue was addressed through improved memory handling. CVE-2018-4090
Kernel An application may be able to read restricted memory A race condition was addressed through improved locking. CVE-2018-4092
Kernel A malicious application may be able to execute arbitrary code with kernel privileges A memory corruption issue was addressed through improved input validation. CVE-2018-4082
Kernel An application may be able to read restricted memory A validation issue was addressed with improved input sanitization. CVE-2018-4093
LinkPresentation Processing a maliciously crafted text message may lead to application denial of service A resource exhaustion issue was addressed through improved input validation. CVE-2018-4100
QuartzCore Processing maliciously crafted web content may lead to arbitrary code execution A memory corruption issue existed in the processing of web content. This issue was addressed through improved input validation. CVE-2018-4085
Security A certificate may have name constraints applied incorrectly A certificate evaluation issue existed in the handling of name constraints. This issue was addressed through improved trust evaluation of certificates. CVE-2018-4086
Wi-Fi An application may be able to read restricted memory A validation issue was addressed with improved input sanitization. CVE-2018-4084

iOS 11.2.5

Component Impact Description CVEs
Audio Processing a maliciously crafted audio file may lead to arbitrary code execution A memory corruption issue was addressed through improved input validation. CVE-2018-4094
Core Bluetooth An application may be able to execute arbitrary code with system privileges A memory corruption issue was addressed with improved memory handling. CVE-2018-4087,CVE-2018-4095
Kernel An application may be able to read restricted memory A memory initialization issue was addressed through improved memory handling. CVE-2018-4090
Kernel An application may be able to read restricted memory A race condition was addressed through improved locking. CVE-2018-4092
Kernel A malicious application may be able to execute arbitrary code with kernel privileges A memory corruption issue was addressed through improved input validation. CVE-2018-4082
Kernel An application may be able to read restricted memory A validation issue was addressed with improved input sanitization. CVE-2018-4093
LinkPresentation Processing a maliciously crafted text message may lead to application denial of service A resource exhaustion issue was addressed through improved input validation. CVE-2018-4100
QuartzCore Processing maliciously crafted web content may lead to arbitrary code execution A memory corruption issue existed in the processing of web content. This issue was addressed through improved input validation. CVE-2018-4085
Security A certificate may have name constraints applied incorrectly A certificate evaluation issue existed in the handling of name constraints. This issue was addressed through improved trust evaluation of certificates. CVE-2018-4086
WebKit Processing maliciously crafted web content may lead to arbitrary code execution Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4088,CVE-2018-4089,CVE-2018-4096

 

watchOS 4.2.2

Component Models Impact Description CVEs
Audio All Apple Watch models Processing a maliciously crafted audio file may lead to arbitrary code execution A memory corruption issue was addressed through improved input validation. CVE-2018-4094
Core Bluetooth All Apple Watch models An application may be able to execute arbitrary code with system privileges A memory corruption issue was addressed with improved memory handling. CVE-2018-4087,CVE-2018-4095
Kernel All Apple Watch models An application may be able to read restricted memory A memory initialization issue was addressed through improved memory handling. CVE-2018-4090
Kernel All Apple Watch models An application may be able to read restricted memory A race condition was addressed through improved locking. CVE-2018-4092
Kernel All Apple Watch models A malicious application may be able to execute arbitrary code with kernel privileges A memory corruption issue was addressed through improved input validation. CVE-2018-4082
Kernel All Apple Watch models An application may be able to read restricted memory A validation issue was addressed with improved input sanitization. CVE-2018-4093
LinkPresentation All Apple Watch models Processing a maliciously crafted text message may lead to application denial of service A resource exhaustion issue was addressed through improved input validation. CVE-2018-4100
QuartzCore All Apple Watch models Processing maliciously crafted web content may lead to arbitrary code execution A memory corruption issue existed in the processing of web content. This issue was addressed through improved input validation. CVE-2018-4085
Security All Apple Watch models A certificate may have name constraints applied incorrectly A certificate evaluation issue existed in the handling of name constraints. This issue was addressed through improved trust evaluation of certificates. CVE-2018-4086
WebKit All Apple Watch models Processing maliciously crafted web content may lead to arbitrary code execution Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4088,CVE-2018-4096

tvOS 11.2.5

Component Impact Description CVEs
Audio Processing a maliciously crafted audio file may lead to arbitrary code execution A memory corruption issue was addressed through improved input validation. CVE-2018-4094
Core Bluetooth An application may be able to execute arbitrary code with system privileges A memory corruption issue was addressed with improved memory handling. CVE-2018-4087,CVE-2018-4095
Kernel An application may be able to read restricted memory A memory initialization issue was addressed through improved memory handling. CVE-2018-4090
Kernel An application may be able to read restricted memory A race condition was addressed through improved locking. CVE-2018-4092
Kernel A malicious application may be able to execute arbitrary code with kernel privileges A memory corruption issue was addressed through improved input validation. CVE-2018-4082
Kernel An application may be able to read restricted memory A validation issue was addressed with improved input sanitization. CVE-2018-4093
QuartzCore Processing maliciously crafted web content may lead to arbitrary code execution A memory corruption issue existed in the processing of web content. This issue was addressed through improved input validation. CVE-2018-4085
Security A certificate may have name constraints applied incorrectly A certificate evaluation issue existed in the handling of name constraints. This issue was addressed through improved trust evaluation of certificates. CVE-2018-4086

 

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS Technology Institute
STI|Twitter|

Defending Web Applications Security Essentials - SANS Amsterdam September 2018

Johannes

3323 Posts
ISC Handler

Sign Up for Free or Log In to start participating in the conversation!