ID

VAR-201804-1200

CVE

CVE-2018-4086

TITLE

plural Apple Vulnerability in product security components spoofing certificate evaluation

DESCRIPTION

An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Security" component. It allows remote attackers to spoof certificate validation via crafted name constraints. Apple iOS/WatchOS/tvOS/macOS are prone to multiple security vulnerabilities. An attacker can exploit these issues to execute arbitrary code with kernel or system privileges, gain sensitive information, bypass security restrictions and perform unauthorized actions and or cause a denial-of-service condition. Apple iOS, macOS High Sierra, tvOS, and watchOS are all products of Apple Inc. in the United States. Apple iOS is an operating system developed for mobile devices; macOS High Sierra is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system; watchOS is a smart watch operating system. A remote attacker can exploit this vulnerability to prevent the device from properly using name restrictions on certificates. The following products and versions are affected: Apple iOS prior to 11.2.5; macOS High Sierra prior to 10.13.3; watchOS prior to 4.2.2; tvOS prior to 11.2.5. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2018-1-23-1 iOS 11.2.5 iOS 11.2.5 is now available and addresses the following: Audio Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved input validation. CVE-2018-4094: Mingi Cho, MinSik Shin, Seoyoung Kim, Yeongho Lee and Taekyoung Kwon of the Information Security Lab, Yonsei University Core Bluetooth Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4087: Rani Idan (@raniXCH) of Zimperium zLabs Team CVE-2018-4095: Rani Idan (@raniXCH) of Zimperium zLabs Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed through improved memory handling. CVE-2018-4090: Jann Horn of Google Project Zero Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to read restricted memory Description: A race condition was addressed through improved locking. CVE-2018-4092: an anonymous researcher Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved input validation. CVE-2018-4082: Russ Cox of Google Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2018-4093: Jann Horn of Google Project Zero LinkPresentation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted text message may lead to application denial of service Description: A resource exhaustion issue was addressed through improved input validation. CVE-2018-4100: Abraham Masri (@cheesecakeufo) QuartzCore Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue existed in the processing of web content. This issue was addressed through improved input validation. CVE-2018-4085: Ret2 Systems Inc. working with Trend Micro's Zero Day Initiative Security Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A certificate may have name constraints applied incorrectly Description: A certificate evaluation issue existed in the handling of name constraints. This issue was addressed through improved trust evaluation of certificates. CVE-2018-4086: Ian Haken of Netflix WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4088: Jeonghoon Shin of Theori CVE-2018-4089: Ivan Fratric of Google Project Zero CVE-2018-4096: found by OSS-Fuzz Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "11.2.5". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlpng6cpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbJVxAA y2gRrvCCEzescN0fgqNk8zIGqaiFRKXYEyuaHMgXjrJIh8OlBgLb3pegU6MFfTsv SjNLDKvPIOW/2vV8ilS6ot32DB4VTANjHKCWTs3jmJrQlWh2VZKvPnzyOiQ0zK2g Btt4+1ZYipRuCyWkf0oatW9JHsCscVexzERyczywBdEzx1mCnCF4N3uOYU0T3Nx2 7Wz92GnvTAnJWjlCJEK1wq/YCntEFhssBVmsWQU1LVPFHoh8uPa87iE/+P1t0CY1 IQLloYmPoX9GIS/CB7XAsEsz3RquE8n/DigSvsApkrl6Judv/HgCYe5GJcwIIemi 1RyNXtj3/+CVZYSwC2Fo/CSyph1M+td79Klqy4gdCVt0KnlmwkKhSexhuQsKn68A /WTcOK7aidcdVuQpjUJAc3pJunl0zHg5bCJRzrb2NdFEoYT0V+kxLEKGlOWRLhXv NSn9+f7pMykSCbfo9U9HkYm68JDtN/WANMCJccF66iQYjEhg0Rgok3oKhNOhakwH HDYunzqF2dEql4WiAKiEAHwVVQ5gJtjDWest6s6UW58fiT2fxufaJav5gczv/wmy km/doFT9+BKmRXygwXdR6P3oRFhZmeLVvjtKpfjPzuIvHkwS7wlOw3aWnZ0rMijm pp7WyqEojXjOxyZjTeBM3A7ssxIuO5BoLtIHgT4GSNg= =F6+9 -----END PGP SIGNATURE----- . CVE-2018-4098: Siguza Kernel Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6 Impact: An application may be able to read kernel memory (Meltdown) Description: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache. CVE-2017-5754: Jann Horn of Google Project Zero; Moritz Lipp of Graz University of Technology; Michael Schwarz of Graz University of Technology; Daniel Gruss of Graz University of Technology; Thomas Prescher of Cyberus Technology GmbH; Werner Haas of Cyberus Technology GmbH; Stefan Mangard of Graz University of Technology; Paul Kocher; Daniel Genkin of University of Pennsylvania and University of Maryland; Yuval Yarom of University of Adelaide and Data61; and Mike Hamburg of Rambus (Cryptography Research Division) Kernel Available for: macOS High Sierra 10.13.2 Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed through improved memory handling. CVE-2018-4097: Resecurity, Inc. Alternatively, on your watch, select "My Watch > General > About"

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

lack of information

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Mingi Cho, MinSik Shin, Seoyoung Kim, Yeongho Lee and Taekyoung Kwon of the Information Security Lab, Yonsei University,Jann Horn of Google Project Zero, an anonymous researcher, Russ Cox of Google, Jann Horn of Google Project Zero, Ret2 Systems Inc. work

SOURCES

LAST UPDATE DATE

2024-11-23T20:21:19.565000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE