Apple fixes four zero-days under attack
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-30661 | Use-After-Free in Apple WebKit Enables Code Execution via Malicious Web Content CVE-2021-30661 is a use-after-free flaw (CWE-416) in the storage handling of Apple's WebKit browser engine, affecting Safari, iOS, iPadOS, macOS, watchOS and tvOS. It is triggered simply by processing maliciously crafted web content, such as a victim loading a hostile web page, with no privileges or authentication required beyond user interaction. A successful attack can lead to arbitrary code execution on the affected device, with confidentiality, integrity and availability all rated high. Anyone running builds older than the fixed versions (Safari 14.1, iOS 12.5.3/14.5, iPadOS 14.5, macOS Big Sur 11.3, watchOS 7.4, tvOS 14.5) is potentially affected. Apple disclosed that the issue was actively exploited at the time of patching; it was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 and EPSS assigns a roughly 4.5% probability of exploitation in the next 30 days. Do: Apply Apple's updates per vendor instructions: Safari 14.1, iOS 14.5/iPadOS 14.5 (or iOS 12.5.3 for older devices that cannot run iOS 14), macOS Big Sur 11.3, watchOS 7.4 and tvOS 14.5. Because the bug was exploited in the wild and is on CISA's KEV list, treat these patches as urgent and prioritize browsers and user workstations; verify that legacy devices still running pre-12.5.3 or pre-14.5 iOS builds are found and updated. No public proof-of-concept is known and patching is the primary mitigation. | 8.8 | 4% | KEV |
| masshundreds of millions to over a billion Apple devices across iOS, iPadOS, macOS, Safari, watchOS and tvOS (order-of-magnitude estimate) | |
| CVE-2021-30666 | WebKit Buffer Overflow in Apple iOS Allows Code Execution via Malicious Web Content CVE-2021-30666 is a buffer overflow (CWE-119) in the WebKit web engine on Apple iOS, caused by improper memory handling. It is triggered remotely when the device processes maliciously crafted web content, meaning a victim only has to encounter attacker-controlled web pages or web content for the flaw to be reached (network vector with user interaction, per the CVSS 3.1 score of 8.8). Successful exploitation can lead to arbitrary code execution on the device with full confidentiality, integrity, and availability impact. All iOS devices running versions before the iOS 12.5.3 fix are affected, with iOS 12.5.3 serving devices that remain on Apple's legacy iOS 12 branch. Apple reported the bug was being actively exploited in the wild when it was patched, CISA added it to the KEV on 2021-11-03, and EPSS assigns a 3% probability of exploitation within 30 days (87th percentile), though no public PoC is known. Do: Upgrade affected devices to iOS 12.5.3 or later, and have devices on newer iOS branches take the corresponding current-branch iOS security updates Apple released at the same time, per CISA's required action to apply updates per vendor instructions. Because the attack vector is web content and no public workaround is documented, patching WebKit is the primary defense, so prioritize older hardware that only receives iOS 12.5.x updates and verify fleet-wide compliance. | 8.8 | 3% | KEV |
| masshundreds of millions of iOS devices (global iPhone install base exceeds 1 billion; devices limited to the legacy iOS 12 branch are in the tens of millions) |
Full article260 words · extracted from helpnetsecurity.com · click to collapse
A week after Apple patched a macOS zero-day exploited by Shlayer malware for months for months, the company has released new security updates for macOS, iOS, iPadOS and watch OS that plug four additional zero-days that “may have been actively exploited”.
The fixed Apple zero-days
macOS Big Sur 11.3.1, iOS 14.5.1 and iPadOS 14.5.1 fix:
- CVE-2021-30665 – a memory corruption issue in WebKit that could lead to arbitrary code execution when a user views (i.e., Safari processes) maliciously crafted web content
- CVE-2021-30663 – an integer overflow vulnerability in WebKit that allows the same thing in the same way
WatchOS 7.4.1 plugs only the first of those security holes (CVE-2021-30665), while iOS 12.5.3 fixes both, as well as two other vulnerabilities that may have been exploited in the wild: CVE-2021-30666 (a buffer overflow issue in WebKit) and CVE-2021-30661 (a use after free issue in WebKit Storage), both of which may lead to arbitrary code execution when a user loads maliciously crafted web content.
WebKit is a browser engine developed by Apple and used by Safari on macOS, iOS and iPadOS. Though watchOS doesn’t have the Safari app, it has WebKit so that Apple Watch users can open web content on the device.
Three of the four fixed vulnerabilities have been flagged by researchers from Beijing-based security firm Qihoo 360, the remaining one by an anonymous researcher.
As per usual, Apple has not shared specific details about the fixed flaws or explained in which attacks they are being exploited. Users are advised to update their Apple devices as soon as possible.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/05/04/apple-fixes-zero-days/