Apple iOS 12.1.3 Security Updates Address Multiple Vulnerabilities

Apple has released iOS 12.1.3 to fix 31 CVEs including a FaceTime remote code execution vulnerability

Background

On January 22, Apple released iOS 12.1.3, which includes fixes for 31 different CVEs across multiple apps and services. This update also includes fixes for CVE-2019-6227 and CVE-2019-6225, which security researcher Qixun Zhao of Qihoo 360 Vulcan Team reportedly used in a code execution attack through FaceTime. The attack requires a user to tap on a malicious link, which could be achieved through social engineering.

Analysis

An attacker could craft a malicious FaceTime link that, when clicked, exploits a kernel bug in iOS allowing the attacker to jailbreak the targeted iOS device. The attacker can then make use of the jailbroken device to remotely take control as a root user.

Social engineering attacks increased in 2018, and with smartphones playing a major part in business, device security is paramount to organizational security. If employees in your organization connect to a corporate network over wifi, or charge their personal devices on their work device USB ports, we recommend encouraging your employees to be as diligent about their personal device updates as the CISO is about corporate assets.

Proof of concept

Qihoo 360 created a proof of concept (PoC) video demonstrating the attack.

Solution

Upgrade iOS devices to version 12.1.3

Identifying affected systems

Tenable Mobile Device Management (MDM) integration can identify mobile devices that are missing vendor updates. A list of our MDM plugins for this update can be found here as they’re released.

Get more information

• Apple Security Information Page for iOS 12.1.3
• 360 Core Security Research Write Up
• CVE-2019-6227
• CVE-2019-6225
• Nessus Plugin List

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.