Apple has revealed that its recent software update fixed a critical zero-day vulnerability used in attacks against iPhone users.
In a security bulletin issued for iOS, iPadOS, Safari, tvOS and macOS Ventura, Apple said the update fixed a critical flaw in the 16.1.2 patch which affected WebKit.
WebKit is used to power the Safari web browser and a host of other apps.
IOS 16.1.2 was rolled out to users on 30th November and saw the introduction of new security tools, including the Advanced Data Protection for iCloud feature, which allows end-to-end encryption for iCloud backups.
In the initial update notes, Apple said this also included “important security updates”.
Security disclosure
According to details in this recent disclosure, Apple described the flaw as a “type confusion issue” in the WebKit engine.
This means that threat actors could use malicious web content to insert code on a user device, insert malware or spyware, or execute malicious OS commands.
Apple warned that it is aware of reports that the issue “may have been actively exploited” against versions of iOS released before the 15.1 update in October.
As such, the tech giant advised users to install the recent security update as soon as possible.
Tom Davison, senior director of Engineering International at Lookout told IT Pro that the recent vulnerabilities raise concerns for businesses, with organisations increasingly relying on mobile devices in daily operations.
“The news of these recently patched zero-day vulnerabilities in iOS should not be a surprise. We have already seen several examples of this in 2022, with 15.3, 15.6.1, and 16.1 all introducing fixes to critical vulnerabilities alleged to have been exploited in the wild,” he said.
“The real concern lies with business. Mobile devices are now an integral part of the employee toolkit. Sensitive data freely flows between the organisation and employee phones. It is absolutely imperative that enterprises take this into account,” Davison added.
WebKit Vulnerabilities
WebKit vulnerabilities have been frequently targeted by threat actors as a means to access device operating systems and exfiltrate sensitive data. This particular method can also be used to exploit other device vulnerabilities.
The WebKit bug, tracked as CVE-2022-42856, was discovered and subsequently disclosed by Clément Lecigne at Google’s Threat Analysis Group.
Additional information from the group on this discovery is yet to be revealed.
Zero-day fixes
RELATED RESOURCE
This latest update marks the 10th zero-day vulnerability fix issued by Apple in 2022. In February, Apple security updates addressed another WebKit-based zero-day bug which had been used to target iPhone, iPad and Mac users.
September also saw a raft of updates issued to affect critical vulnerabilities, including four code-execution flaws and one serious zero-day affecting iOS and iPadOS.
Tracked as CVE-2022-32917, the flaw enabled hackers to executive arbitrary code with kernel privileges.
Just one month later, Apple released an additional update which once again included patches for iOS and iPadOS due to an actively exploited zero-day.
The vulnerability was caused by an out-of-bounds write error in the kernel, which could be used by threat actors to execute malicious code.
-
Cleo attack victim list grows as Hertz confirms customer data stolenNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
Lateral moves in tech: Why leaders should support employee mobilityIn-depth Encouraging staff to switch roles can have long-term benefits for skills in the tech sector
-
Hackers are targeting Ivanti VPN users again – here’s what you need to knowNews Ivanti has re-patched a security flaw in its Connect Secure VPN appliances that's been exploited by a China-linked espionage group since at least the middle of March.
-
Broadcom issues urgent alert over three VMware zero-daysNews The firm says it has information to suggest all three are being exploited in the wild
-
Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claimNews Over 200 vulnerable Nakivo backup instances have been identified months after the firm silently patched a security flaw.
-
Everything you need to know about the Microsoft Power Pages vulnerabilityNews A severe Microsoft Power Pages vulnerability has been fixed after cyber criminals were found to have been exploiting unpatched systems in the wild.
-
Vulnerability management complexity is leaving enterprises at serious riskNews Fragmented data and siloed processes mean remediation is taking too long
-
A critical Ivanti flaw is being exploited in the wild – here’s what you need to knowNews Cyber criminals are actively exploiting a critical RCE flaw affecting Ivanti Connect Secure appliances
-
Researchers claim an AMD security flaw could let hackers access encrypted dataNews Using only a $10 test rig, researchers were able to pull off the badRAM attack
-
A journey to cyber resiliencewhitepaper DORA: Ushering in a new era of cyber security
