Apple: Customers who use their iPhones and iPads may be at risk. According to an advisory that was released by the Indian Computer Emergency Response Team (CERT-In), multiple vulnerabilities have been reported in Apple iOS and iPadOS. These vulnerabilities could allow a remote attacker to gain access to sensitive information on the targeted device, execute arbitrary code, spoof the interface address, or cause a denial of service conditions.
Which Apple products are impacted by this issue?
According to the advisory, the vulnerability known as CVE-2022-42827 affects Apple iOS 16.1, previous versions of Apple iOS (up to and including 16.0.3), and iPadOS versions (up to and including 16). Apple iPhone 8 and later models, iPad Pro Call models, iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later are all included on the list of affected devices.
Why are Apple products susceptible to this flaw in the first place?
CERT-In explains in its advisory that these vulnerabilities can be found in Apple’s iOS and iPadOS because of the following: Improper security restrictions in the AppleMobileFileIntegrity component; Improper bounds check in the Avevideoencoder component; Improper validation in the CrNetwork component.
- Incorrect memory handling in the GPU Drivers component – Incorrect entitlement in the Core Bluetooth component
- A problem with memory corruption in the IOHIDFamily component.
- Use after free problem and race condition problem in IOKit component Improper memory handling and out-of-bounds write the problem in Kernel component Use after free problem and race condition problem in PPP component Improper memory handling and out-of-bounds write the problem in PPP component Use after free problem and race condition problem in IOKit component
- Inadequate security restrictions in the Sandbox component as well as inadequate path validation
- Incorrect UI handling, an issue with type confusion, and a problem with logic in the Webkit component.
- A use-after-free error in the WebKit PDF component.
- Incorrect input validation in the Mail component.
How exactly does the vulnerability affect people who use iPhones?
These vulnerabilities can be exploited by a remote attacker in order to trick the victim into opening a file or application that has been specially crafted by the attacker. If an attacker was able to successfully exploit these vulnerabilities on the targeted system, they could gain access to sensitive information, execute arbitrary code, spoof the interface address, or cause a denial of service conditions.
What actions should users take?
According to the advisory issued by CERT-In, the vulnerability is being exploited out in the wild. Users are strongly encouraged to implement software updates as described in Apple’s latest security updates.
Keep watching our YouTube Channel ‘DNP INDIA’. Also, please subscribe and follow us on FACEBOOK, INSTAGRAM, and TWITTER
