Apple iOS 4 out of 5 Security flaws Disclosed, By Google Researchers
By Prempal Singh
Google’s researchers have finally disclosed details and proof-of-concept exploits for security flaws in Apple iOS that impact the iOS operating system and can be exploited via the iMessage client. The vulnerabilities don’t require any user interaction to be exploited.
All the flaws, Details about one of the “interactionless” vulnerabilities have been kept private because Apple’s iOS 12.4 patch did not completely resolve the bug and the researchers Samuel Groß and Natalie Silvanovich of Google Project Zero, has reported to Apple.
According to the researchers, four of the Five security Flaws can lead to the execution of malicious code on a remote iOS device, which doesn’t need user interaction. All an attacker would need to do is to send a malformed message to a victim’s phone, and the malicious code will execute once the user opens and views the received item.
However, researchers have kept (CVE-2019-8641) private because the latest patch update did not completely address this issue, but disclosed the details and exploit for three of these four flaws.
The fifth vulnerability (CVE-2019-8646), an out-of-bounds read, can also be executed remotely by just sending a malformed message via iMessage. But instead of code execution, this allows an attacker to read the data of files stored on the victim’s iOS device by leaked memory.
These are the following iOS vulnerability that has disclosed.
CVE-2019-8647 is a use-after-free flaw that resides in the Core Data framework that can cause arbitrary code execution due to insecure deserialization when the NSArray initWithCoder method is used. This vulnerability can be exploited remotely via iMessage and crash Springboard without any user interaction.
CVE-2019-8662 is a flaw that can be exploited remotely via iMessage without any user interaction, that resides in the QuickLook component of iOS.
CVE-2019-8660 is a memory corruption issue that resides in the Core Data framework and Siri component. The vulnerability could be exploited by attackers to cause an unexpected application termination or arbitrary code execution.
CVE-2019-8646 is a flaw that could be exploited by an attacker to read the content of files stored on iOS devices remotely without user interactions, that resides in the Siri and Core Data iOS components.
One of these flaws has not disclosed by Google researcher, tracked as CVE-2019-8641 because the Apple iOS update patch did not completely address the flaw.
Besides these 5 vulnerabilities, Silvanovich also last week released details and a PoC exploit for another out-of-bounds read vulnerability that also allows remote attackers to leak memory and read files from a remote device.
The vulnerability, assigned as CVE-2019-8624, resides in Digital Touch component of watchOS and affects Apple Watch Series 1 and later. The issue has been patched by Apple this month with the release of watchOS 5.3.