Security Researchers Delve Into Major Vulnerability Patched in iOS 16.3 and macOS 13.2

[MacRumors]

With almost every iOS and macOS update, Apple includes a host of security improvements to address major vulnerabilities. iOS 16.3 and macOS Ventura 13.2, released back in January, were no exception. Both updates included fixes for a long list of issues, including two that were highlighted today in a report from Trellix.

Trellix Advanced Research Center discovered a new class of privilege execution bugs within iOS and macOS, which could be exploited to delve into an iPhone or Mac user's messages, location data, photos, call history, and more.

In a blog post highlighting how the bug was found, Trellix explains how mitigations that Apple introduced for the FORCEDENTRY zero-click exploit in September 2021 could by bypassed, allowing for a "huge range of potential vulnerabilities."

Trellix found its first vulnerability in the coreduetd process, which could be used to give an attacker access to a person's calendar, address book, and photos. Vulnerabilities in OSLogService and NSPredicate were able to be exploited to achieve code execution within Springboard, providing attackers access to the camera, microphone, call history, and more.

Data about these vulnerabilities was relayed to Apple, and the company fixed the exploits in iOS 16.3 and macOS 13.2 Ventura. Security support documents for both updates were refreshed yesterday to reflect the addition of the patches.

Trellix is credited with two vulnerabilities (CVE-2023-23530 and CVE-2023-23531) that Apple patched with improved memory handling. Trellix said that it thanks Apple for working quickly to fix the issues.

Article Link: Security Researchers Delve Into Major Vulnerability Patched in iOS 16.3 and macOS 13.2

 

[madmin]

It's us users who pay the price for Apple's recent lack of software quality

 

[centauratlas]

Apple seems to be rushing changes without sufficient engineering and design behind them. One hopes that they are learning from this but I doubt it.

 

[6787872]

apple stans in panic mode after realizing the walled garden is useless

 

[Realityck]

Related

About the security content of iOS 16.3 and iPadOS 16.3 – Apple Support (UK)

This document describes the security content of iOS 16.3 and iPadOS 16.3.

support.apple.com

About the security content of iOS 16.3.1 and iPadOS 16.3.1 – Apple Support (UK)

This document describes the security content of iOS 16.3.1 and iPadOS 16.3.1.

support.apple.com

You can't say Apple and third party software security contributors aren't keeping up with what gets found.

 

[Realityck]

apple stans in panic mode after realizing the walled garden is useless

MacOS is not a walled garden.

 

[I7guy]

I guess according every other vendor in the world writes code that is 100% bug free with no vulnerabilities.

 

[I7guy]

It's us users who pay the price for Apple's recent lack of software quality

It's us users who pay the price for Apple's recent lack of software quality

What recent? https://forums.macrumors.com/thread...14-launch-the-worst-ever-not-so-fast.2361027/

 

[NT1440]

It's us users who pay the price for Apple's recent lack of software quality

Show me one piece of software that doesn’t have bugs and I’ll show you a piece of software that just hasn’t been examined enough.

This is the world of modern software, millions of interacting libraries, improper error checking in places that no one should be able to get to but a different exploit was found to allow for it, etc.

This isn’t an obvious “password is in plaintext” kind of security flaw. This is a chain of flaws. This is how the world works now.

 

[rgwebb]

It's us users who pay the price for Apple's recent lack of software quality

Weird takeaway from a story about Apple rapidly responding to a white hat security team's notification of vulnerabilities.

 

[ToomeyND]

MacOS is not a walled garden.

You aren't wrong there. But isn't the vulnerability also in iOS? Hence the 16.3 patch?

 

[6787872]

MacOS is not a walled garden.

it's close enough.

 

[Pecka]

What about Monterey, is it also affected?

 

[addamas]

What about VPNs leaking „safe” data ? I wonder if it’s patched

 

[Gengar]

At least they fixed it 🤷🏿‍♂️

 

[citysnaps]

I guess according every other vendor in the world writes code that is 100% bug free with no vulnerabilities.

It's astonishing so many people believe that's true.

Apparently everything else in their lives marches to 100.0% perfection 100.0% of the time.

 

[Stridder44]

Are prior versions of macOS still vulnerable to this?

 

[code-m]

Related

About the security content of iOS 16.3 and iPadOS 16.3 – Apple Support (UK)

This document describes the security content of iOS 16.3 and iPadOS 16.3.

support.apple.com

About the security content of iOS 16.3.1 and iPadOS 16.3.1 – Apple Support (UK)

This document describes the security content of iOS 16.3.1 and iPadOS 16.3.1.

support.apple.com

You can't say Apple and third party software security contributors aren't keeping up with what gets found.

Compared to the alternative that not only has vulnerabilities with the OS (normal) but also the apps (degrees of safeguards) but also the OS provider harvests user information which is a triple threat.

While Apple is not immune to the first two the third is completely within their control.

 

[adamw]

Glad to see Apple fixing their operating systems for the Mac and iOS. Hopefully Apple will continue to do extensive quality control on everything that they release, before they release it.

 

[Deep_learned_mistake]

Why don't the hackers just turn off the ability to update your device once they have root?

 

[addamas]

It astonishing so many people apparently believe that's true.

Apparently everything else in their lives marches to 100.0% perfection 100.0% of the time.

This is full truth.
I wonder how many times I got on my work HP laptop keyboard updates via Windows Update…
Nothing is fully secure, even calculator app might have issues (who remember what Apple did to it? )

 

[nwcs]

It's us users who pay the price for Apple's recent lack of software quality

Apple seems to be rushing changes without sufficient engineering and design behind them. One hopes that they are learning from this but I doubt it.

I'd like to see you guys do better writing code for an impatient world... Either that or point out any significant platform that doesn't have vulnerabilities and problems? or is it that you just don't like Apple for some reason?

 

[BobSc]

It's us users who pay the price for Apple's recent lack of software quality

This is an article about Apple's rapid response to some serious bugs. And yet the Apple haters appear no matter what.

Do the haters know how hard it can be to write software, especially an OS? And it's so much more complicated and difficult than it was 10 years ago. You want more and more advanced features, and then if there is a bug you folks automatically repeat the same words of hate you use in so many other posts. The haters can't even wait to consider the issue before they condemn the companies that have a bug.

I'd like to learn what the mindset is that makes someone continue to use software/hardware from a company that they hate and have no respect for or confidence in. After all, there are other companies from which you can buy hardware/software. I hear that Microsoft makes perfect software with NO bugs.

 

[roar08]

Apparently everything else in their lives marches to 100.0% perfection 100.0% of the time.

I think people would crap themselves if they were aware of the undiscovered, unpatched and often unknowingly exploited vulnerabilities in their everyday IoT devices: doorbells, refrigerators, cameras, thermostats, etc., etc.

Most people think the only threats are the reported and/or patched vulns in "computers" and "phones". The snake that bites you is the one you don't see.

 

[max2]

I think people would crap themselves if they were aware of the undiscovered, unpatched and often unknowingly exploited vulnerabilities in their everyday IoT devices: doorbells, refrigerators, cameras, thermostats, etc., etc.

Most people think the only threats are the reported and/or patched vulns in "computers" and "phones". The snake that bites you is the one you don't see.

Exactly.