Apple Fixes Actively Exploited iPhone Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-42856 | Type Confusion in Apple WebKit (Safari/iOS/macOS/tvOS), Actively Exploited CVE-2022-42856 is a type confusion vulnerability (CWE-843) in Apple's WebKit web engine, addressed with improved state handling and affecting Safari, iPhone OS (iOS), iPadOS, macOS (Ventura) and tvOS. It is triggered when a user processes maliciously crafted web content, for example by visiting an attacker-controlled web page, in a WebKit-based browser or app. Successful exploitation may lead to arbitrary code execution on the affected device. Anyone running the affected Apple platforms below the December 2022 patch level (Safari 16.2, macOS Ventura 13.1, tvOS 16.2, iOS/iPadOS 15.7.2, iOS 16.1.2) was exposed, which effectively means most Apple users at the time of disclosure. Exploitation is confirmed: Apple reported the issue may have been actively exploited against iOS versions released before iOS 15.1, it was added to CISA KEV on 2022-12-14 (EPSS 8.5%, 95th percentile), and related reporting ties it to commercial spyware campaigns in Italy, Malaysia, Kazakhstan and the UAE. Do: Update immediately to Safari 16.2, macOS Ventura 13.1, tvOS 16.2, and iOS/iPadOS 15.7.2 (for iOS 15-era devices) or iOS 16.1.2 (for iOS 16-era devices), or any later release; this is a CISA KEV entry whose required action is to apply vendor updates. Because the flaw was exploited as a zero-day against iOS versions before iOS 15.1 and is linked to commercial spyware campaigns, treat patching as urgent and verify that all managed and BYOD iPhones and iPads are on a fixed version; on iOS, all third-party browsers and most web-content apps use WebKit, so the OS update itself is the remediation rather than switching browsers. | 8.8 | 9% | KEV |
| mass~1 billion+ Apple devices at disclosure (every iOS/iPadOS/macOS/tvOS device below the December 2022 patch level; Apple's active installed base exceeds 1… |
Full article392 words · extracted from infosecurity-magazine.com · click to collapse
Apple has announced that an iPhone software update released two weeks ago fixed a zero-day security flaw (tracked CVE-2022-42856) that had been actively exploited in the wild.
The iOS 16.1.2 patch was released on November 30 and progressively rolled out to all supported iPhones, quoting unspecified "important security updates."
Updating its security bulletin on Tuesday, Apple said the patch fixed a flaw in WebKit, the browser engine behind Safari and other iOS apps. If exploited, the vulnerability could allow remote code execution (RCE) on the victim's device.
"Processing maliciously crafted web content may lead to arbitrary code execution," the company wrote. "Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1."
Commenting on the news, Tom Davison, senior director of sales engineering international at Lookout, said the news of another zero-day vulnerability in iOS should not be surprising.
"We have already seen several examples of this in 2022, with 15.3, 15.6.1, and 16.1 all introducing fixes to critical vulnerabilities alleged to have been exploited in the wild," Davison told Infosecurity.
"There is a market for these flaws amongst sophisticated threat actors, and more will certainly be discovered. Users should configure automatic iOS updates to stay protected."
More broadly, the executive believes the fundamental concerns associated with these flaws lie with business.
"Mobile devices are now an integral part of the employee toolkit. Sensitive data freely flows between the organization and employee phones. It is absolutely imperative that enterprises take this into account by including the security and monitoring of mobile devices alongside all other computing endpoints."
At the same time, according to Travis Biehn, principal security consultant at the Synopsys Software Integrity Group, it is good to see private industry coordinating to protect people.
"Apple invests a lot into operating system security, compartmentalization of components, sandboxing, and assessments of WebKit – but it does show you that, for complex software like a web browser written in C++, spending a lot of money on assurance won't keep all the bugs out," Biehn explained.
"Developers are slowly adopting new languages like Rust and experimenting with sandbox approaches that can further isolate legacy code written in non-memory-safe languages like C and C++."
The Apple patch comes days after the company introduced new data protection features focused on protecting users against data theft.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/apple-fixes-exploited-iphone-zero/