Tag: Zero-day

Apple releases iOS and iPadOS 16.6.1, macOS Ventura 13.5.2 and watchOS 9.6.2. These releases contain security updates addressing zero day vulnerabilities.

Apple Support:

• About the security content of macOS Ventura 13.5.2
• About the security content of iOS 16.6.1 and iPadOS 16.6.1
• About the security content of watchOS 9.6.2

References:

• iOS 16.6.1 for iPhone now available with important security fixes
• PSA: Make Sure to Update, iOS 16.6.1 and macOS 13.5.2 Address Actively Exploited Vulnerability
• Apple fixed zero-day exploit used by Pegasus spyware with iOS 16.6.1
• Exploit patched in iOS 16.6.1 update delivered Pegasus spyware
• iOS 16.6.1 patches security vulnerabilities in Wallet and more

Apple releases bug fix releases – iOS and iPadOS 15.4.1, macOS 12.3.1 and watchOS 8.5.1. HomePod software is also updated to 15.4.1 version.

iOS fixes include battery drain fix, macOS Monterey now should have Bluetooth game controllers working properly.

Reference:

• Apple releases iOS 15.4.1 with battery issues fix for iPhone and iPad
• Apple Releases watchOS 8.5.1 With Security Updates and Bug Fixes
• Apple Releases HomePod 15.4.1 Software With Siri Fix
• Apple Releases iOS 15.4.1 With Fix for Battery Drain Issue
• Apple Releases macOS Monterey 12.3.1 With Bluetooth and Display Fixes
• macOS 12.3.1 fixes bug affecting game controllers and other Bluetooth devices
• Apple fixes multiple zero-day exploits with iOS 15.4.1 and macOS 12.3.1

Safari 15 is exposing IndexedDB data to opened sites and in tabs and recently opened.

Sites cannot read contents of IndexedDB, however, names of databases are accessible to all sites. Google keeps user ID as a part of database name allowing cross-site tracking.

Live demo: Safari Leaks

Reference:

• Safari bug can leak some of your Google account info and recent browsing history
• Safari Bug Allows Websites to Track Your Recent Browsing Activity in Real Time
• Safari 15 IndexedDB Information Leaks

Log4j is a popular Java logging package used by many backends.

Details of the vulnerability are available here, and according to reports, also libraries or solutions using Apache log4j (we are talking about Steam, iCloud or Minecraft servers) are also vulnerable. Solutions using the Struts library are also probably vulnerable.

Affected log4j versions: 2.0 <= Apache log4j <= 2.14.1

As reported earlier, Apple seemed to ignore reports on zero-day vulnerabilities in iOS. Now story continues with report from Denis Tokarev. Apple contacted him and apologized for the delays in response.

"We saw your blog post regarding this issue and your other reports. We apologize for the delay in responding to you," an Apple employee wrote. "We want to let you know that we are still investigating these issues and how we can address them to protect customers. Thank you again for taking the time to report these issues to us, we appreciate your assistance. Please let us know if you have any questions."

Motherboard

Security researcher Denis Tokarev shared an articles disclosing several zero-day exploits.

Issues are expected to be fixed following the public exposure.

Apple patches security issues (including zero-day exploit) in iOS 12.5.5 for devices which could not be updated to iOS 14.

AppleInsider reports that Apple partially fixed vulnerability in macOS Big Sur allowing attackers to run arbitrary code via specially crafted email.

Vulnerability involves usage of file:// URL scheme, and currently Apple checks for it in case sensitive manner allowing attackers to use mixed cases. Proper fix is yet to come.

Amnesty International posts a report on NSO Group's Pegasus software used to attack iPhones. Attacks were already used on journalists.

Attack includes zero-click iMessage exploit allowing private data access on iPhones. Currently, no clear indications on which iOS versions are affected, but it seems that iOS 14.6 is vulnerable.