Advisories

CERT-In Advisory CIAD-2021-0036

Multiple vulnerabilities in Apple products

Original Issue Date: September 24, 2021

Severity Rating: High

Software Affected

Apple macOS Catalina
Apple iOS prior to 12.5.5

iPhone 5s
iPhone 6
iPhone 6 Plus
iPad Air
iPad mini 2
iPad mini 3
iPod touch (6th generation)

Overview

Multiple vulnerabilities have been reported in multiple products of Apple which could be exploited by a remote attacker to execute arbitrary code and take control of a targeted device.

Description

1. Integer overflow vulnerability ( CVE-2021-30860   )

This vulnerability exists due to integer overflow when processing PDF files within the CoreGraphics component. A remote attacker could exploit this vulnerability to process a specially crafted PDF file, to trigger an integer overflow and execute arbitrary code on the target system.

2. Use after free vulnerability ( CVE-2021-30858   )

The vulnerability exists due to a use after free error when processing HTML content in WebKit. A remote attacker could persuade an unsuspected victim to visit a specially crafted web page, triggering a use after free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

3. Type Confusion vulnerability ( CVE-2021-30869   )

This vulnerability exists in the XNU subsystem due to a type confusion error. A remote, authenticated attacker could run a specially crafted program to trigger a type confusion error and execute arbitrary code with kernel privileges.

Note: These vulnerabilities are currently being exploited in the wild, users are advised to apply patches urgently.

Solution

Apply appropriate updates as mentioned in Apple Security updates:
https://support.apple.com/en-us/HT212824
https://support.apple.com/en-us/HT212825

Vendor Information

Apple
https://support.apple.com/en-us/HT212824
https://support.apple.com/en-us/HT212825

References

Apple
https://support.apple.com/en-us/HT212824
https://support.apple.com/en-us/HT212825

CVE Name
CVE-2021-30860
CVE-2021-30858
CVE-2021-30869

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India