Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.3350.2
APPLE-SA-2018-10-30-4 watchOS 5.1
1 November 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Apple WatchOS
Publisher: Apple
Operating System: Apple iOS
Impact/Access: Root Compromise -- Existing Account
Execute Arbitrary Code/Commands -- Remote with User Interaction
Access Privileged Data -- Remote/Unauthenticated
Increased Privileges -- Existing Account
Cross-site Scripting -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Provide Misleading Information -- Remote with User Interaction
Reduced Security -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2018-4426 CVE-2018-4425 CVE-2018-4420
CVE-2018-4419 CVE-2018-4416 CVE-2018-4414
CVE-2018-4413 CVE-2018-4412 CVE-2018-4408
CVE-2018-4407 CVE-2018-4401 CVE-2018-4400
CVE-2018-4399 CVE-2018-4398 CVE-2018-4395
CVE-2018-4394 CVE-2018-4392 CVE-2018-4386
CVE-2018-4384 CVE-2018-4383 CVE-2018-4382
CVE-2018-4378 CVE-2018-4377 CVE-2018-4376
CVE-2018-4375 CVE-2018-4374 CVE-2018-4373
CVE-2018-4372 CVE-2018-4371 CVE-2018-4369
CVE-2018-4368 CVE-2018-4363 CVE-2018-4361
CVE-2018-4359 CVE-2018-4358 CVE-2018-4354
CVE-2018-4347 CVE-2018-4344 CVE-2018-4343
CVE-2018-4341 CVE-2018-4340 CVE-2018-4337
CVE-2018-4336 CVE-2018-4332 CVE-2018-4331
CVE-2018-4319 CVE-2018-4313 CVE-2018-4311
CVE-2018-4305 CVE-2018-4304 CVE-2018-4299
CVE-2018-4203 CVE-2018-4191 CVE-2018-4126
CVE-2016-1777
Reference: ESB-2018.3347
Original Bulletin:
https://support.apple.com/en-au/HT209195
https://support.apple.com/kb/HT201222
Comment: This bulletin contains two (2) Apple security advisories.
Revision History: November 1 2018: New CVEs added
October 31 2018: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-4 watchOS 5.1
watchOS 5.1 is now available and addresses the following:
AppleAVD
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4384: Natalie Silvanovich of Google Project Zero
CoreCrypto
Available for: Apple Watch Series 1 and later
Impact: An attacker may be able to exploit a weakness in the
Miller-Rabin primality test to incorrectly identify prime numbers
Description: An issue existed in the method for determining prime
numbers. This issue was addressed by using pseudorandom bases for
testing of primes.
CVE-2018-4398: Martin Albrecht, Jake Massimo and Kenny Paterson of
Royal Holloway, University of London, and Juraj Somorovsky of Ruhr
University, Bochum
ICU
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted string may lead to heap
corruption
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4394: an anonymous researcher
IPSec
Available for: Apple Watch Series 1 and later
Impact: An application may be able to gain elevated privileges
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2018-4371: Tim Michaud (@TimGMichaud) of Leviathan Security Group
Kernel
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed by removing the
vulnerable code.
CVE-2018-4420: Mohamed Ghannam (@_simo36)
Kernel
Available for: Apple Watch Series 1 and later
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed with
improved memory handling.
CVE-2018-4413: Juwei Lin (@panicaII) of TrendMicro Mobile Security
Team
Kernel
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4419: Mohamed Ghannam (@_simo36)
NetworkExtension
Available for: Apple Watch Series 1 and later
Impact: Connecting to a VPN server may leak DNS queries to a DNS
proxy
Description: A logic issue was addressed with improved state
management.
CVE-2018-4369: an anonymous researcher
Safari Reader
Available for: Apple Watch Series 1 and later
Impact: Enabling the Safari Reader feature on a maliciously crafted
webpage may lead to universal cross site scripting
Description: A logic issue was addressed with improved validation.
CVE-2018-4374: Ryan Pickren (ryanpickren.com)
Safari Reader
Available for: Apple Watch Series 1 and later
Impact: Enabling the Safari Reader feature on a maliciously crafted
webpage may lead to universal cross site scripting
Description: A cross-site scripting issue existed in Safari. This
issue was addressed with improved URL validation.
CVE-2018-4377: Ryan Pickren (ryanpickren.com)
Security
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted S/MIME signed message may
lead to a denial of service
Description: A validation issue was addressed with improved logic.
CVE-2018-4400: Yukinobu Nagayasu of LAC Co., Ltd.
WebKit
Available for: Apple Watch Series 1 and later
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4372: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST
Softsec Lab, Korea
CVE-2018-4373: ngg, alippai, DirtYiCE, KT of Tresorit working with
Trend Micro's Zero Day Initiative
CVE-2018-4375: Yu Haiwan and Wu Hongjun From Nanyang Technological
University working with Trend Micro's Zero Day Initiative
CVE-2018-4376: 010 working with Trend Micro's Zero Day Initiative
CVE-2018-4382: lokihardt of Google Project Zero
CVE-2018-4386: lokihardt of Google Project Zero
CVE-2018-4392: zhunki of 360 ESG Codesafe Team
CVE-2018-4416: lokihardt of Google Project Zero
WebKit
Available for: Apple Watch Series 1 and later
Impact: Processing maliciously crafted web content may lead to code
execution
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4378: an anonymous researcher, zhunki of 360 ESG Codesafe
Team
WiFi
Available for: Apple Watch Series 1 and later
Impact: An attacker in a privileged position may be able to perform a
denial of service attack
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4368: Milan Stute and Alex Mariotto of Secure Mobile
Networking Lab at Technische Universität Darmstadt
Additional recognition
Certificate Signing
We would like to acknowledge Yigit Can YILMAZ (@yilmazcanyigit) for
their assistance.
Security
We would like to acknowledge Marinos Bernitsas of Parachute for their
assistance.
Installation note:
Instructions on how to update your Apple Watch software are
available at https://support.apple.com/kb/HT204641
To check the version on your Apple Watch, open the Apple Watch app
on your iPhone and select "My Watch > General > About".
Alternatively, on your watch, select "My Watch > General > About".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
- -----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgYpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3EA8g/+
Ll91rTID6pn6oncXh+evrELJOBBZwZZh2mRNHh/yFK2bIt7v6MLas+ez9cDh8SXE
dvS5EeIBwNDr7drVbk14JOLADKsDcJUEfCUHCno1iJfAzIQC5N+eJyzgNZlOlzXG
8sNKn7gv2VxVW6CXKbSSX2VgyZ+UUIpU6Bmoj4ZsasycBLBNG6ZC+07ZAZfxBpL4
jcJz1Zq0ZueaxwV+21Are/51pMzC3tHuO77BTWCV8OTLROi72BuvfLtIcLG0HkRS
nKsB3Qt6NcwuzvPR0HedCWsH+2DR3fyHNkHou47KM0vlW5BmgvVXj6KOTMvVm3o0
3WegNySOTPKyUdVWNQWm/n3TqwuT7Ahpfb+tg0nCQ+7cS7DukFfHET++J21ihNpG
YHUqa/dCnvNj+F7aUHwsW9aL7ZXsJphyRBhG5896z56N5diSPQ2rAnszgvGVNyEW
PXEVCFcOOGuxvkN20LP+/EawOb/NTp2JlL5HexzBpYmH88GMjIN1pYQmG4izSG3M
P0uQTui3aBE39wR2BwUSkI0PVxmumqDGKPk+exyxExcOuPPQo2OwIxki8az2taMf
6iFjZWyIeS5ZwHy8XOca7Oe+4yM8WLnfPiX34JkdH5a0hsC1Y/e6E5IhGwpNcpnt
q3709XOMbW2YjH1WyGrjUGgrrOJbq3Y5XM7dvkuXsuY=
=m0yh
- -----END PGP SIGNATURE-----
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-10 Additional information for
APPLE-SA-2018-9-24-5 watchOS 5
watchOS 5 addresses the following:
CFNetwork
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
CoreFoundation
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreFoundation
Available for: Apple Watch Series 1 and later
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4414: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreText
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4347: an anonymous researcher
Entry added October 30, 2018
Grand Central Dispatch
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4426: Brandon Azad
Entry added October 30, 2018
Heimdal
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4331: Brandon Azad
CVE-2018-4332: Brandon Azad
CVE-2018-4343: Brandon Azad
Entry added October 30, 2018
IOHIDFamily
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed with improved
input validation
CVE-2018-4408: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to break out of its
sandbox
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4341: Ian Beer of Google Project Zero
CVE-2018-4354: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4383: Apple
Entry added October 30, 2018
IOUserEthernet
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4401: Apple
Entry added October 30, 2018
iTunes Store
Available for: Apple Watch Series 1 and later
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to leak sensitive user
information
Description: An access issue existed with privileged API calls. This
issue was addressed with additional restrictions.
CVE-2018-4399: Fabiano Anemone (@anoane)
Entry added October 30, 2018
Kernel
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4337: Ian Beer of Google Project Zero
CVE-2018-4340: Mohamed Ghannam (@_simo36)
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative,
Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Kernel
Available for: Apple Watch Series 1 and later
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel. This
issue was addressed with improved input validation.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: Apple Watch Series 1 and later
Impact: An attacker in a privileged network position may be able to
execute arbitrary code
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4407: Kevin Backhouse of Semmle Ltd.
Entry added October 30, 2018
Safari
Available for: Apple Watch Series 1 and later
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots. The issue was addressed with improved handling
of application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah Maide Aznenek Anadolu Lisesi -
Ankara/Turkiye, Mehmet Ferit Daltan of Van Yanel
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Security
Available for: Apple Watch Series 1 and later
Impact: A local user may be able to cause a denial of service
Description: This issue was addressed with improved checks.
CVE-2018-4395: Patrick Wardle of Digita Security
Entry added October 30, 2018
Security
Available for: Apple Watch Series 1 and later
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Symptom Framework
Available for: Apple Watch Series 1 and later
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2018-4203: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Text
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted text file may lead to a
denial of service
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4304: jianan.huang (@Sevck)
Entry added October 30, 2018
WebKit
Available for: Apple Watch Series 1 and later
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
WebKit
Available for: Apple Watch Series 1 and later
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)
WebKit
Available for: Apple Watch Series 1 and later
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel Groiz (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel Groiz (@5aelo)
WebKit
Available for: Apple Watch Series 1 and later
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
This was addressed with improved tracking of security origins.
CVE-2018-4319: John Pettitt of Google
WebKit
Available for: Apple Watch Series 1 and later
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by OSS-Fuzz
Additional recognition
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Kernel
We would like to acknowledge Brandon Azad for their assistance.
Sandbox Profiles
We would like to acknowledge Tencent Keen Security Lab working with
Trend Micro's Zero Day Initiative for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
WebKit
We would like to acknowledge Tencent Keen Security Lab working with
Trend Micro's Zero Day Initiative for their assistance.
Installation note:
Instructions on how to update your Apple Watch software are
available at https://support.apple.com/kb/HT204641
To check the version on your Apple Watch, open the Apple Watch app
on your iPhone and select "My Watch > General > About".
Alternatively, on your watch, select "My Watch > General > About".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
- -----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgUpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3GbihAA
rJrGRlOECVnj/z6kzobQ6SjqeXQanrEJKOEbP12pOEgOcqhJd/CsRIGMGxtG8cRC
H60/qGsVtDXhqmGZQl2cBaMeg+bagLvSaRUC6urXqYLIKoGay7zsbQyWS4hAbyNu
Gpu0k5bvb2tr3IZIfqHfUcScxpsB3zJiYejtgLow2MDbkt84qNqx73xYbOIXDJoc
kfyNhb/RKqiXOi5Yvh+E84GARjUSGUFD5fMbIMu7Lf0cwGpL3XakKG8S+8L0W3/W
vGsl7V8DWeH6qbVoMkLUxWGxWzCd4bUr88J0cybski3L4SvpYbDPMMKxQkyn4Rfq
qSDG3RMS0MUeoGn/iwRcJ8p6gPMGjWTT+lvX0XaZzG3b/mkOw8C2jRs1Ds8vUbRB
Pxn1AQvg0x+EW/HIKqrvbE6i5pLjhurHYChy9tI9AS2iSHsAnrSB8DV8mc4T4v6a
zJqJO5qPPCVJ9K328l+FyXe+X5erQP4/dwol71VjweA/peSJCL34/YL3oSs9e41R
ApabYVIphnq0Ion5gVNancPhgQEbkIjMncFiGRg4wF0jly2Ni+NsnDquTKEM3VvG
mOlo0VVw3XxLhtiQF/RKbQSy+6dK0YGykIsmnz/DsstxS4xRiWbk75XErA/nSwPs
fHAicxI2AmpI+PbdYcPI4D3eJr/1ZDH8NvY1897WX5c=
=fz+z
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW9pXj2aOgq3Tt24GAQhZIRAAnkJg73EbQJfT0ThTdGJZYmXLL+WpAH4j
YmmYDMM4mUNfvtwWquKEQS7cGQRVZYVZweFl/a30imlpSQ9eHHZnmwDYL4+bYuo4
LaS/i0wLBBNCDZ4ok1sBK5h1NRlhoZeGUQq06IHGfyN1LftJuwiwAwdmsaFYo3ow
65TZ2SPLDQoscfT7tvZ/KgtgMKr5jUeQzom9yfe77rAaHYZNOWnIgemMwf7uSApY
mjRskrKT5aWbm06R9QKAFz1BEQk+5wUnoZ+DB0DdJzW27n969N0rHyHgtT1raLha
qyN6VrJhmZ9HS1ldYyVbbG+Rh/6rh/h9fJjX/GvycALH7T5OzKAegGa2HsL7zya8
/XirD4qAu6o3zkP79sKKGb5Qv/Ek2KeNEh5Zc95S+3TWP8HKonykkA/Di1L3CtCl
dT2w5Wm/8rd22oHCg97sYHkZwk/aT8ZbdJ9Q8FbdNoRJ2dIvK3hw5wrHa6iph0Is
jwxIhRU2TU5W7HTye4lw7+AffdQTU8JQdS9egzEWjb1DzJQH/QsJptSU20BJHOne
swepymOZKJfbdjh2+VYvQHQ6tpMkKUAo97t2zM3BGcCCtTJI4HASy1/LcBUev34Q
KbyDC+Mh6DjAVQwEy23RxiOiX4wGmjNDQ6Lki1PIX+a44g1WkL8DD+tO3pTbEU4P
hOLsH7X5hXo=
=0CUn
-----END PGP SIGNATURE-----