Operating System:

[Apple iOS]

Published:

19 September 2018

Protect yourself against future threats.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.2778
                             watchOS 5 updates
                             19 September 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Apple watchOS
Publisher:         Apple
Operating System:  Apple iOS
Impact/Access:     Access Privileged Data         -- Existing Account      
                   Provide Misleading Information -- Remote/Unauthenticated
                   Reduced Security               -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-4363 CVE-2018-4313 CVE-2018-4305
                   CVE-2016-1777  

Reference:         ESB-2016.2961
                   ESB-2016.0748

Original Bulletin: 
   https://support.apple.com/en-au/HT209108

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-2018-9-17-2 watchOS 5

watchOS 5 is now available and addresses the following:

iTunes Store
Available for: Apple Watch Series 1 and later
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime

Kernel
Available for: Apple Watch Series 1 and later
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel. This
issue was addressed with improved input validation.
CVE-2018-4363: Ian Beer of Google Project Zero

Safari
Available for: Apple Watch Series 1 and later
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots. The issue was addressed with improved handling
of application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott,
Enes Mert Ulu of Abdullah Murside Ozunenek Anadolu Lisesi -
Ankara/Turkiye, Mehmet Ferit Dastan of Van Yunzuncu Yil University, 
Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)

Security
Available for: Apple Watch Series 1 and later
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky

Installation note:

Instructions on how to update your Apple Watch software are
available at https://support.apple.com/kb/HT204641

To check the version on your Apple Watch, open the Apple Watch app
on your iPhone and select "My Watch > General > About".

Alternatively, on your watch, select "My Watch > General > About".

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
- -----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlud5zQACgkQeC9tht7T
K3FV9hAAtX6gDqHABD9ceNOS2nKF4CYYKkObac9J6UYiRnygTAn0FY7fxvEKuOSz
LS976VqorWl2+95u9H3BffjP3bJM8dvlbMlOWl4vpj1cYmswovv0sO1tKF2oqt9z
hrMZ9hIkzpDdwBMbjS6Tx7VHO/A42DQkOs271El2uH+Ua1i6+1xOlbyJ8EDzCmSy
ksgxxuzvHkaaWZJWPkkW7+/H+PliHsFVnyjhxjvs0Gl+aXn/cZFPqdAbRTw34ApS
ATwMWt5VCmIPJhoijx6pGIVhlMlllyaw7neAGkUG5LCmj6irpmHi0TB3Br3bzs3s
8tEv5bDzwKigr1IidcA7MCndEqpuJb6LyId9sEgExSGAr722RBro4dPZb+2S6cZ3
PWm2chZKJXMknvgxb8FWCx7VS3UaKoxCxWPuP7cVs2N5xjQzFcM5BCfzuldu6XYd
6UoLucW95iC0/ZD3/OzEeqhNdy6iXntg80YSFWJzLNZ2bkkTwd6WG1Y6o2lTtdba
audddBD2Ux+m+Mbb2gUeW7sBYTNqx9vPFZZR7qme+kRJ8+c/WvAhgORy6GqyWErn
fQx6HZdypilQy+MZkTvTxNeGZi/qdblL20I1TGRPPvTPtMw6Q7hHqdsJWurew/jQ
C6QUtN88Vq6zBEhpN12Y62G7OHchJTovYB5fGwnZ3Kb8QOfidyw=3D
=3DYFA1
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBW6GxpmaOgq3Tt24GAQiKnBAAhPVyN9DCK1El3HIol8n4XRyqmVv8tJeb
yI1+GS669H0w+Qn9HycyxNstY2oBosz1WJwgXneiGgmVaJncE6vqY2M+AVY0We2Z
Bb5F7Jkm51Yqf80ID4dbEWiG0qbE+e7CQJ3GiZbGwMsMFMBCJXFWRhu/w/gjMvDo
TpBEHxmc/8Jkrp/6QL3pkOm0uQ/uo4u0l//b/KSliRQ9xZO/fc7GJKAPNA0FecC8
I4CEHC6HDI0hGOQ6FjtTugdAgWWQ+UOeGfNsGa2gZ5vVCYGZmEpz+LqTfrOvKpSK
bnT8EWU4jllDtzICNTCSSuzfl4/0MVnBf/ULGaAGLkSoPBXrx5NmhATq894Bt0Gh
i0QotdsPvFD78N1H/ACym2GnpXLXQtVUisAB7KYlaZmcuH2OtJ08SEO5Ao203fwb
cwe1ELdUoefgBe0DXvOdXKwbkvTIXRhh0uKbT5QWfAS0hpezc8hb/2hIS6iFGh2i
/y9U8QIIPakgh7oRMrIeb5jVUZhkMcpj40Us04GYLtYWdDPA22AKdwuELbx0DXVL
5ZEiDy0LFMkyQ4yQQcoKQ1MWjgSuo6Cm0woTRMxfg6nU13gdBdhgfFEJ9toeNZuf
5ch16ABz25XaV0l+jbukk8pgtrxH5x6wGuQ2+GUstPV3N6XwUMliuyzJtY30wQSk
O6F+UKk/pKc=
=UD7X
-----END PGP SIGNATURE-----