Apple Issues Emergency Updates to iPhones After Exploits Found

[IceWizard]

Apple Issues Emergency Updates to iPhones
After Exploits Found








Apple released iOS 16.4.1 on April 7, about two weeks after the firm released its
previous update to the operating system. The update was deployed to fix vulnerabilities
that could be actively exploited.

While the tech giant didn’t offer many details about the fixes, it said that the bugs,
tracked as CVE-2023-28205 and CVE-2023-28206, were fixed in its latest update,
according to an Apple support page.

“For our customers’ protection, Apple doesn’t disclose, discuss, or confirm security
issues until an investigation has occurred and patches or releases are available.
Recent releases are listed on the Apple security updates page,”
Apple states on its website.

Security firm Sophos, in describing the fix as an “emergency patch,” said that
CVE-2023-28205 is a “hole in Webkit,” or the engine of the Safari browser, that can
allow a compromised website to “give cybercriminals control over your browser,
or indeed any app that uses WebKit to render and display HTML content.” A number
of apps and browsers—not just Safari—use WebKit.

“Apple’s own Safari browser uses WebKit, making it directly vulnerable to
WebKit bugs,” it said. “Additionally, Apple’s App Store rules mean that all browsers
on iPhones and iPads must use WebKit, making this sort of bug a truly cross-browser
problem for mobile Apple devices.”

The second bug, CVE-2023-28206, involves a security hole in IOSurfaceAccelerator
that can allow an app to execute code with kernel privileges, meaning an attacker
can target the core of the code in iOS if it isn’t patched.

“This bug allows a booby-trapped local app to inject its own rogue code right into
the operating system kernel itself. Kernel code execution bugs are inevitably much
more serious than app-level bugs, because the kernel is responsible for managing
the security of the entire system, including what permissions apps can acquire,
and how freely apps can share files and data between themselves,” Sophos wrote.

In each of the two cases, Apple stated on its website that it was “aware of a report
that this issue may have been actively exploited.” Users should update their iPhones,
iPads, MacBooks, and other Apple devices that use iOS 16.4 as soon as possible,
Sophos and other security researchers say.

Consumers can manually update to the latest version on their iPhones or iPads by
going to Settings, General, and Software Update. Then, they should click Download
and Install, follow the prompts, and wait for the phone to restart.

On Mac laptops and desktop computers, it’s similar. Users can open the Apple menu
and choose System Settings before going to General and then clicking on Software Update.