U.S. government employees with Apple devices must apply the latest patches by May 1 to protect their endpoints from potential compromise.
BleepingComputer recently announced that the Cybersecurity and Infrastructure Agency (CISA) has ordered federal agencies to apply patches to fix CVE-2023-28206 and CVE-2023-28205 on iPhone, Mac computers, and iPad devices. Reported.
These flaws are reportedly being actively exploited in the wild, giving attackers complete access to targeted devices. In an advisory released with the fix, the Cupertino giant said, “Apple is aware of reports that this issue may have been actively exploited.
Many devices affected The first was an out-of-bounds write vulnerability in IOSurface that allowed attackers to corrupt data, crash apps and devices, and execute code remotely.Worst case scenario is an attacker with malicious intent (opens in new tab) Apps that can execute arbitrary code with kernel privileges on the device.
Another is WebKit which gives similar results. If a victim visits a malicious website, data corruption, arbitrary code execution, and remote code execution occur.
This vulnerability has been addressed in the releases of iOS 16.4.1, iPadOS 16.4.1, macOS Ventura 13.3.1, and Safari 16.4.1, so if you’re concerned about these vulnerabilities, keep your system up to date. please. as soon as.
Apple has published a list of vulnerable hardware. This includes all iPad Pro and macOS Ventura devices, as well as iPad, iPad Mini, and iPad Air devices (the first two from 5th generation onwards and the latter from 3rd generation onwards). iPhone 8 and newer smartphones are also affected.
The company said it was aware of threat actors exploiting zero-days in the wild, but did not provide details. Given the fact that the flaw was discovered, we speculate that the attackers may be state-sponsored.
The researchers who discovered this flaw are Clément Lecigne of Google’s Threat Analysis Group and Donncha Ó Cearbhaill of Amnesty International’s Security Lab. The vulnerability was apparently used as part of an exploit chain.
Via: BleepingComputer (opens in new tab)
websitebuildersnow
GIPHY App Key not set. Please check settings