Jump to content

Recommended Posts

Apple.jpg

 

Apple has released security updates to fix two zero-day vulnerabilities that have been seen exploited in the wild to attack iPhones and Macs. One is known to be used to install the Pegasus spyware on iPhones.

 

The vulnerabilities are tracked as CVE-2021-30860 and CVE-2021-30858, and both allow maliciously crafted documents to execute commands when opened on vulnerable devices.

 

The CVE-2021-30860 CoreGraphics vulnerability is an integer overflow bug discovered by Citizen Lab that allows threat actors to create malicious PDF documents that execute commands when opened in iOS and macOS.

 

CVE-2021-30858 is a WebKit use after free vulnerability allowing hackers to create maliciously crafted web page that execute commands when visiting them on iPhones and macOS.  Apple states that this vulnerability was disclosed anonymously.

 

Quote

"Apple is aware of a report that this issue may have been actively exploited," the company said in security advisories published today regarding both vulnerabilities.

 

While Apple did not release any further information on how the vulnerabilities were used in attacks, Citizen Lab has confirmed that CVE-2021-30860 is a zero-day zero-click iMessage exploit named 'FORCEDENTRY.'

 

The FORCEDENTRY exploit was discovered to be used to bypass the iOS BlastDoor security feature to deploy the NSO Pegasus spyware on devices belonging to Bahraini activists.

 

BleepingComputer has contacted Citizen Lab with further questions about the attacks but has not heard back at this time.

 

Apple zero-days run rampant in 2021

 

It has been a very busy year for Apple with what seems like an unending streaming of zero-day vulnerabilities used in targeted attacks against iOS and Mac devices.

 

 

Project Zero also disclosed 11 zero-day vulnerabilities this year that were used in attacks targeting Windows, iOS , and Android devices.

 

Update 9/13/21: Added confirmed from Citizen Labs that this update fixes the FORCEDENTRY vulnerability.

 

Source

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...