Apple iOS 12.1.3 Security Updates Address Multiple Vulnerabilities
Apple has released iOS 12.1.3 to fix 31 CVEs including a FaceTime remote code execution vulnerability
Background
On January 22, Apple released iOS 12.1.3, which includes fixes for 31 different CVEs across multiple apps and services. This update also includes fixes for CVE-2019-6227 and CVE-2019-6225, which security researcher Qixun Zhao of Qihoo 360 Vulcan Team reportedly used in a code execution attack through FaceTime. The attack requires a user to tap on a malicious link, which could be achieved through social engineering.
Analysis
An attacker could craft a malicious FaceTime link that, when clicked, exploits a kernel bug in iOS allowing the attacker to jailbreak the targeted iOS device. The attacker can then make use of the jailbroken device to remotely take control as a root user.
Social engineering attacks increased in 2018, and with smartphones playing a major part in business, device security is paramount to organizational security. If employees in your organization connect to a corporate network over wifi, or charge their personal devices on their work device USB ports, we recommend encouraging your employees to be as diligent about their personal device updates as the CISO is about corporate assets.
Proof of concept
Qihoo 360 created a proof of concept (PoC) video demonstrating the attack.
Solution
Upgrade iOS devices to version 12.1.3
Identifying affected systems
Tenable Mobile Device Management (MDM) integration can identify mobile devices that are missing vendor updates. A list of our MDM plugins for this update can be found here as they’re released.
Get more information
- Apple Security Information Page for iOS 12.1.3
- 360 Core Security Research Write Up
- CVE-2019-6227
- CVE-2019-6225
- Nessus Plugin List
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.
Related Articles
Spotlight on Japan: Digital Transformation Initiatives Heighten Risk Levels
October 18, 2021As Japanese organizations roll out digital transformation initiatives and expand remote workforces, security teams need to address new risks in the new world of work. The rapid transition to remote w...
Spotlight on Brazil: Remote Work Requires New Risk Management Practices
October 14, 2021Remote work is here to stay — along with the risks it introduces to Brazilian organizations, if not managed properly. Here's what you need to know. The pandemic forced many Brazilian organizations to...
Cybersecurity Awareness: Six Tips to Help Your Employees Be Cybersmart
October 7, 2021We believe it's time for a new approach to cyber awareness, one that borrows on the concept of the shared responsibility model common in cloud computing. Here's how we get there. How much considerati...
Active Directory Under Attack: Five Eyes Guidance Targets Crucial Security Gaps
November 21, 2024A landmark global report from cybersecurity agencies emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the first of our two-part series, we offer five steps you can take today to shore up your AD defenses.
Five Cyber Agencies Sound Alarm About Active Directory Attacks: Beyond the Basics
November 21, 2024A landmark global report emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the second of our two-part series, we take you beyond the basics to highlight three key areas to focus on.
Volt Typhoon: What State and Local Government Officials Need to Know
November 19, 2024Increased activity from the state-sponsored threat group Volt Typhoon raises concerns about the cybersecurity of U.S. critical infrastructure. Here’s how you can identify potential exposures and attack paths.
- BYOD
- Vulnerability Management