Apple is in the news a lot recently thanks to the new products it has announced. These products include the iPhone X and iPhone 8, as well as the Apple Watch with cellular connectivity. What missed the news, except for more IT-oriented publications, is the recent mobile operating system patch update, aka iOS 11. In this update, numerous potentially dangerous exploits were patched, with the total number being 8 CVEs. Let’s take a look at some of the most critical of these vulnerabilities.
As reported in a notice on Apple’s support section of their main website, the patched exploits varied in danger. Overall, each exploit affects these Apple products: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation. The first vulnerability patched in iOS 11 of note is CVE-2017-7106, which was disclosed to Apple by Oliver Paukstadt of Thinking Objects GmbH (to.com). The main threat with this exploit is the ability for a browser’s address bar to be spoofed (aka hijacked) by an attacker if a malicious website is visited. Apple stated that the cause of this vulnerability was “An inconsistent user interface issue” that the patch fixed via “improved state management.”
Another patch of note is CVE-2017-7072, which was uncovered by Jędrzej Krysztofiak. The vulnerability affects iBooks, namely by allowing for the possibility of “a persistent denial-of-service” that is caused by “parsing a maliciously crafted iBooks file.” The patch for this exploit was created by, according to Apple’s own description, “improved memory handling.”
One final patch worth discussing of the 8 CVEs covered in the iOS 11 update is CVE-2017-7133, which was first discovered by Don Sparks of HackediOS.com. Affecting MobileBackup, the vulnerability affects the application’s ability to encrypt. As Apple states, “Backup may perform an unencrypted backup despite a requirement to perform only encrypted backups.” The fix for the issue had entirely to do with permissions, as the patch created “improved permission validation.”
I highly recommend reading the full patch report linked to above to get an idea of how much is compromised in an unpatched iOS device. After this, get to patching as quickly as you can, as some of these exploits can really ruin your day.
Photo credit: Apple