Apple releases patches for NSO Group's ForcedEntry zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-30858 | Use-After-Free in WebKit on Apple iOS, iPadOS, and macOS Allows Arbitrary Code Execution CVE-2021-30858 is a use-after-free memory corruption flaw (CWE-416) in the web content processing component (WebKit) of Apple iOS, iPadOS, and macOS, which Apple addressed with improved memory management. An attacker triggers it by getting a victim to process maliciously crafted web content, typically by visiting or being redirected to an attacker-controlled site, and successful exploitation leads to arbitrary code execution on the victim's device (CVSS 3.1: 8.8 High, network vector with user interaction required). Anyone running affected builds of iOS, iPadOS, or macOS, or the affected component on Fedora or Debian Linux per the CPE data, is exposed, since virtually all Apple devices process web content by default. Apple acknowledged that the flaw was being actively exploited, reportedly as part of NSO Group's 'ForcedEntry' targeted zero-day espionage chain, and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03. No public proof-of-concept is known, but the confirmed in-the-wild use makes rapid patching urgent. Do: Update iPhones and iPads to iOS/iPadOS 14.8 and Macs to macOS Big Sur 11.6 immediately, and on Fedora or Debian apply the distribution's updated WebKit packages. Use MDM or inventory data to confirm no managed devices remain on pre-patch builds, since the flaw was exploited as a zero-day in targeted espionage operations. This is a CISA KEV entry (added 2021-11-03), so the catalog's required action of applying vendor updates is mandatory for federal agencies and strongly recommended for everyone else. | 8.8 | 13% | KEV |
| mass>1 billion users/devices (Apple's 1B+ active device base, all of which carry the vulnerable web-content code path) | |
| CVE-2021-30860 | Integer Overflow in Apple PDF Processing Enables Arbitrary Code Execution (CVE-2021-30860) CVE-2021-30860 is an integer overflow (CWE-190) in PDF processing across Apple's platforms that was addressed with improved input validation. It is triggered when a device processes a maliciously crafted PDF — notably when a PDF is rendered after being received via messaging — and successful exploitation allows arbitrary code execution in the context of the PDF renderer. Affected products include iOS/iPadOS, macOS (Big Sur and Catalina), and watchOS, as well as the Xpdf and Poppler PDF libraries, which share lineage with the vulnerable code. Apple confirmed the issue was being actively exploited in the wild, and public reporting ties it to NSO Group's 'ForcedEntry' exploit chain used to deliver Pegasus spyware; CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03. Given the very high EPSS score (76%, 99th percentile) and confirmed active exploitation, defenders should treat this as a high-priority patch. Do: Update iPhones/iPads to iOS/iPadOS 14.8, Macs to macOS Big Sur 11.6 (or apply Security Update 2021-005 Catalina), and Apple Watch to watchOS 7.6.2 immediately, and patch Poppler/Xpdf through distribution or vendor updates. Because the flaw was exploited via crafted PDFs delivered through messaging (ForcedEntry/Pegasus), organizations and individuals at risk of targeted spyware should also review devices for signs of compromise. CISA KEV requires applying updates per vendor instructions; prioritize internet-connected and high-value user endpoints. | 7.8 | 76% | KEV |
| mass>1 billion active Apple devices (iPhones, iPads, Macs, Apple Watches), plus Poppler present by default on most Linux desktops and servers |
Full article579 words · extracted from therecord.media · click to collapse
Apple has released security updates today to patch ForcedEntry, a professional exploit developed by Israeli spyware maker NSO Group, and which has been abused to hack into the phones of multiple activists since February this year. Patches are available today for macOS, iOS, iPadOS, and watchOS. Tracked as CVE-2021-30860, the ForcedEntry zero-day exploits a bug in CoreGraphics, an Apple component for drawing 2D graphics. When weaponized, ForcedEntry allows NSO customers to send maliciously crafted PDF files to a victim's Apple device and run malicious code that takes over their systems. Citizen Lab, a political, human rights, and cybersecurity research center at the University of Toronto, was credited with discovering this zero-day. In reports published in August and earlier today, Citizen Lab researchers said they found ForcedEntry deployed on the iPhones of activists in Bahrain and Saudi Arabia. The researchers said they believe the exploit has been used in attacks since at least February this year. In its August report, Citizen Lab said that NSO Group appears to have specifically developed ForcedEntry as a way to bypass a new security feature called BlastDoor that Apple added in iOS 14 in the fall of 2020. In addition, Apple's security updates today also include a patch for a second zero-day, tracked as CVE-2021-30858. Reported by an anonymous researcher, this bug impacts Safari's WebKit browser engine and was also abused in the wild, but details about its exploitation have not been revealed. Patches for this zero-day were released for macOS, iOS, and iPadOS. These two zero-days represent the 14th and 15th zero-days Apple has patched this year. Reached out for comment, Apple provided the following statement after several news publications blew the zero-day's severity out of proportion. After identifying the vulnerability used by this exploit for iMessage, Apple rapidly developed and deployed a fix in iOS 14.8 to protect our users. We’d like to commend Citizen Lab for successfully completing the very difficult work of obtaining a sample of this exploit so we could develop this fix quickly. Attacks like the ones described are highly sophisticated, cost millions of dollars to develop, often have a short shelf life, and are used to target specific individuals. While that means they are not a threat to the overwhelming majority of our users, we continue to work tirelessly to defend all our customers, and we are constantly adding new protections for their devices and data.Target Description Date(s) of Hacking Moosa Abd-Ali * Activist (Sometime before September 2020) Yusuf Al-Jamri Blogger (Sometime before September 2019) Activist A Member of Waad September 16, 2020 Activist B * Member of Waad, Labor Law Researcher June 3, 2020 July 12, 2020 July 19, 2020 July 24, 2020 August 6, 2020 September 15, 2020 Activist C Member of Waad September 14, 2020 Activist D * Member of BCHR September 14, 2020 Activist E Member of BCHR February 10, 2021 Activist F * Member of BCHR July 11, 2020 July 15, 2020 July 22, 2020 October 13, 2020 Activist G * Member of Al Wefaq (Sometime before October 2019) Activist H Based in Saudi Arabia March 2021 Safari zero-day also patched
No previous article
No new articles
Catalin Cimpanu
is a cybersecurity reporter who previously worked at ZDNet and Bleeping Computer, where he became a well-known name in the industry for his constant scoops on new vulnerabilities, cyberattacks, and law enforcement actions against hackers.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/apple-releases-patches-for-nso-groups-forcedentry-zero-day