Advisories

CERT-In Advisory CIAD-2024-0058

Multiple Vulnerabilities in Apple Products

Original Issue Date: November 21, 2024

Severity Rating: High

Software Affected

Apple iOS and iPadOS versions prior to 18.1.1
Apple iOS and iPadOS versions prior to 17.7.2
Apple macOS Sequoia versions prior to 15.1.1
Apple visionOS versions prior to 2.1.1
Apple Safari versions prior to 18.1.1

Overview

Two vulnerabilities were reported in Apple products, which could be exploited by an attacker to execute arbitrary code or perform XSS attacks on the affected device.

Target Audience:
Individuals and organizational users of Intel-based Mac systems, including macOS, iOS, and iPadOS devices

Risk Assessment:
High risk of unauthorized access, data theft, or gain control of affected system.

Impact Assessment:
Potential for unauthorized access to sensitive user information, denial of service and data manipulation.

Description

1. Arbitrary Code Execution Vulnerability ( CVE-2024-44308 )

This vulnerability exists in JavaScriptCore, which is used by Apple's Safari browser and other applications to process JavaScript. An attacker could exploit this issue to execute arbitrary code execution by sending maliciously crafted web content to the affected device.

2. Cross-Site Scripting Vulnerability ( CVE-2024-44309 )

The vulnerability exists in WebKit, the engine that powers Safari and web content on Apple devices. An attacker could exploit this issue by sending maliciously crafted web content to trigger cross-site scripting (XSS) on the affected device.

Note: These vulnerabilities may have been actively exploited on Intel-based Mac systems. Users are strongly advised to update their devices to the latest software versions to mitigate the risk.

Solution

Apply appropriate security updates as mentioned in the Apple Security Updates:
https://support.apple.com/en-us/121753
https://support.apple.com/en-us/121752
https://support.apple.com/en-us/121754
https://support.apple.com/en-us/121755
https://support.apple.com/en-us/121756

Vendor Information

Apple
https://support.apple.com/en-us/121753
https://support.apple.com/en-us/121752
https://support.apple.com/en-us/121754
https://support.apple.com/en-us/121755
https://support.apple.com/en-us/121756

References

https://support.apple.com/en-us/121753
https://support.apple.com/en-us/121752
https://support.apple.com/en-us/121754
https://support.apple.com/en-us/121755
https://support.apple.com/en-us/121756

CVE Name
CVE-2024-44308
CVE-2024-44309

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India