The issue was addressed with improved validation on the FaceTime server. This issue is fixed in macOS Mojave 10.14.3 Supplemental Update, iOS 12.1.4. A thorough security audit of the FaceTime service uncovered an issue with Live Photos .

The version of Apple iOS running on the mobile device is prior to 12.1.4. It is, therefore, affected by multiple vulnerabilities:

 - A logic issue in the handling of Group FaceTime calls could allow the initiator to cause the recipient to answer. (CVE-2019-6223)

 - An unspecified memory corruption issue in Foundation could lead to an application gaining elevated privileges. (CVE-2019-7286)

 - An unspecified memory corruption issue in IOKit could lead to an application executing arbitrary code with kernel privileges.
 (CVE-2019-7287)

 - An unspecified issue with Live Photos in FaceTime.
 (CVE-2019-7288)

The remote host is running a version of macOS 10.14.3 that is missing the macOS 10.14.3 Supplemental Update.  This update fixes the following vulnerabilities :

  - An unspecified flaw exists related to handling Group     FaceTime calls that allows an attacker to cause a call     recipient to unintentionally answer. (CVE-2019-6223)

  - An input-validation flaw exists related to the     Foundation component that allows memory corruption and     privilege escalation. (CVE-2019-7286)

  - An unspecified flaw exists related to Live Photos in     FaceTime having unspecified impact. (CVE-2019-7288)

The version of Apple iOS running on the mobile device is prior to 12.1.4. It is, therefore, affected by multiple vulnerabilities:

  - A logic issue in the handling of Group FaceTime calls could allow     the initiator to cause the recipient to answer. (CVE-2019-6223)

  - An unspecified memory corruption issue in Foundation could lead     to an application gaining elevated privileges. (CVE-2019-7286)

  - An unspecified memory corruption issue in IOKit could lead to an     application executing arbitrary code with kernel privileges.
    (CVE-2019-7287)

  - An unspecified issue with Live Photos in FaceTime.
    (CVE-2019-7288)

ID	Name	Product	Family	Severity
700557	Apple iOS < 12.1.4 Multiple Vulnerabilities (APPLE-SA-2019-2-07-1)	Nessus Network Monitor	Mobile Devices	high
122508	macOS 10.14.3 Supplemental Update	Nessus	MacOS X Local Security Checks	critical
121645	Apple iOS < 12.1.4 Multiple Vulnerabilities	Nessus	Mobile Devices	critical

Detections

Analytics

CVE-2019-7288

critical

Tenable Plugins

high

critical

critical