July 17, 2023
.webp)
Apple released a patch for a zero-day vulnerability on August 17, 2022. This vulnerability can let hackers and other bad actors maliciously exploit and take control of iOS devices, iPhones,iPad, or a PC with macOS Monterey.
Apple’s Latest patch are for
As per information available on Apple’s support site which has security update information, it has identified CVE-2022-32894 as a vulnerability discovered by an anonymous researcher.
It also mentions that once the attacker gains access to the kernel privileges it can execute arbitrary code. If you are not technical you need to understand that arbitrary code can have bad intentions and your iPhone, iPad or mac can be controlled by the attacker and your personal data can be exploited. It also has a report related to the vulnerability which indicates the issue may have already been exploited.
The technical description mentions an out-of-bounds write issue, which means the system writes data past the end, or before the beginning, of the intended buffer. which can result in corruption of data, a crash, or code execution.
The software can modify an index or perform pointer arithmetic that references a memory location that is outside of the buffer. Unexpected results are produced when a subsequent write operation is performed.
In addition, Apple has also rolled out a fix for a vulnerability affecting WebKit, the engine used by Safari, Mail, and many other iOS and macOS apps.
The exploit is one of many that allow attackers to arbitrarily execute code and could thus be used to, among other things, download more malware.
Like the Kernel vulnerability, Apple identifies it as CVE-2022-32893 and credits an anonymous researcher for the discovery of this flaw — it also knows that it may have already been exploited and used to compromise iOS and Mac devices.
The released patch from apple is for both the flaws identified in macOS Monterey 12.5.1 operating system and should address this flaw.
Both of these vulnerabilities impact the same sets of iOS devices, particularly: iPhone 6S and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th gen and later, and iPod touch 7th generation.
Since both flaws are likely being actively exploited right now, It might be wise for apple device owners to install the patch that would protect them from being attacked over the web.
If you have a company-owned iPhone, mac, or iPad, you should ask your corporate IT support for patches and from where to download them.
—– Extract from apple support site—–
iOS 15.6.1 and iPadOS 15.6.1
Released August 17, 2022
Kernel
Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
Impact: An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2022-32894: an anonymous researcher
WebKit
Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: An out-of-bounds write issue was addressed with improved bounds checking.
WebKit Bugzilla: 243557
CVE-2022-32893: an anonymous researcher
Source: https://support.apple.com/en-us/HT213413
The term ‘vulnerability’ comes from information security. When something or someone has access to sensitive information, it becomes vulnerable. That means that if it gets into the wrong hands, they can use it against you.
Vulnerabilities can be defined as weaknesses in software or hardware design allowing attackers to compromise systems or networks. Vulnerabilities can be exploited using a variety of techniques such as social engineering, phishing, malware, SQL injection, etc. Data breaches happen due to system vulnerablities.
A vulnerable system allows hackers to take control over the device and steal sensitive information or perform unwanted actions. In other words, these are the holes through which they can enter the system and cause damage.
A zero-day vulnerability is an unknown or newly-discovered flaw in a product, service, or system that could be exploited to cause.
An attack that uses a zero-day exploit is called a zero-day attack.
CVE stands for Common Vulnerabilities and Exposures. It is a vulnerability management tool that helps companies detect and prioritize vulnerabilities in their software.
It was developed by The MITRE Corporation (a non-profit organization) in 2001, and has become the de facto standard for security assessment.
CVE is a free, open-source, widely adopted vulnerability management framework that provides organizations with the ability to identify, classify and prioritize vulnerabilities.
When a reference to CVE is made, it means a security flaw that’s been assigned a CVE ID number.
CVEs are used by IT professionals to coordinate efforts to prioritize and address the security flaws of the system.
Certainly, this vulnerability is a concern for all the users of impacted apple devices. The first thing you should do is update your iOS iPadOS and install the patch.
Check below links for more information.
Discussion Forum on iOS 15.6.1 and iPadOS 15.6.1
Get Apple help with security issues
Contact apple support.
In case you have had transactional apps like banking, health and hade your private information like card details etc. You should immediately change the passwords of all the PII information.
It’s iOS 15.6.1 and iPadOS 15.6.1 .
Safari also has an update 15.6.1 released on 18 Aug 2022 for macOS Big Sur and macOS Catalina.
Check the CVE website for updated information
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32894
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32893
Most people who become victims of internet crimes are unaware that they have been victimized until law enforcement authorities contact them. Therefore, it is critical that users take steps to protect themselves from becoming victims of cybercrime.
Here are some tips to help prevent being victimized by these attacks:
• Use strong passwords, preferably 8 characters or longer. Keep your password safe! Do not share it with anyone.
• Do not download software from untrusted websites or email attachments. If you do download something from an unknown website, check its authenticity before installing
• When downloading files from the web, always verify the file’s integrity before opening it. Use anti-virus programs to scan downloaded files for viruses.
• Be careful about clicking links in emails or instant messages. Never open an attachment without verifying its sender first.
• Avoid clicking on ads in pop-up windows. These ads often contain malicious code that infects your PC.
• Always update your operating system. Be sure to regularly download updates from Microsoft and Norton Antivirus Software.
• Keep your browser settings updated. Many web browsers offer automatic updating features. Always keep your version of a browser current.
• If you receive an unsolicited email, never click on embedded links contained within the message. Instead, delete the message immediately.
• Never give out personal information over the phone unless you know whom you are speaking with.
• If you ever find yourself in a situation where someone threatens you or asks for sensitive information, immediately notify law enforcement officials.
• Read privacy policies carefully before you provide personal information. You should also read the terms and conditions before signing up for an online account.
