iOS, Mac vulnerabilities allow remote code execution through a single image

ZDNet ^ | July 22, 2016 -- 09:59 GMT (02:59 PDT) | By Charlie Osborne

[Swordmaker]

Researchers have discovered that image files can bury malware, allowing malicious code access without detection.

Security flaws which affect both Apple iOS and Mac devices permit attackers to grab your passwords and data, researchers claim.

According to researchers from Cisco's Talos, a set of five vulnerabilities, if exploited, could lead to data theft and remote code execution -- which in its worst state may result in device hijacking.

The set of bugs, CVE-2016-4631, CVE-2016-4629, CVE-2016-4630, CVE-2016-1850, and CVE-2016-4637, are all caused by how Apple processes image formats. Apple offers APIs as interfaces for accessing image data, and according to Talos, there are five remote code execution flaws related to this system.

The image files which place Mac and iOS users at risk are .tiff, often used in publishing, OpenEXR, Digital Asset Exchange file format XML files, and BMP images.

The researchers say that the .tiff image processing vulnerability is of particular concern as it can be triggered in any application which uses the Apple API when rendering the images. As a result, an attacker could deliver a malicious payload through a wide range of attack vectors -- including iMessage, malicious web pages, MMS messages, or through malicious email attachments.

The malware avoids detection due to the processing weaknesses, and if exploited, this leads to a heap buffer flow issue which extends to remote code execution.

"Furthermore, depending on the delivery method chosen by an attacker, this vulnerability is potentially exploitable through methods that do not require explicit user interaction since many applications (i.e. iMessage) automatically attempt to render images when they are received in their default configurations," Talos notes.

Apple has patched these vulnerabilities in the latest version of iOS, Mac OS X, tvOS, and watchOS. To stay safe, users should make sure their software is up-to-date.

[Swordmaker]

Please note, this is NOT a zero day exploit, as claimed nor was it discovered by researchers because it was unknown to Apple. It requires FIVE different things to happen for it to be an exploit, and the only reason that anyone knows about it is that Apple PATCHED these vulnerabilities last week! One thing that this article fails to mention that the final thing is a Heap Buffer Overflow problem, but on both Macs and iOS devices the heaps are hardware Non-Executable memory areas, so such a heap overflow could never be exploited. At worst, it would result in an error message and the crash of an App.

All anyone has to do to avoid any malicious result of these vulnerabilities is to run a fully up-to-date version of iOS 9.3.3 or OS X.11.6 El Caplitan.

[Swordmaker]

Apple patched some vulnerabilities in both iOS and OS X which a security company is now claiming could, if used in concert, have been used to exploit both operating systems. . . but that really is not true because the final step relies on a Heap Buffer Overflow which is actually a hardware locked out, protected non-executable memory area in both systems and cannot be used to execute code, regardless of an overflow or not. Since Apple has already fixed everyone of these vulnerabilities LAST WEEK, the way to avoid ever running into even the potential for a problem is to be running up-to-date versions of iOS 9.3.3 and OS X.11.6 El Capitan. Update now. Since this is not a problem, this article is mostly FUD. — PING!

Keeping Your Apple Devices Secure
By Keeping The Up-To-Date
Ping!

The latest Apple/Mac/iOS Pings can be found by searching Keyword "ApplePingList" on FreeRepublic's Search.

If you want on or off the Mac Ping List, Freepmail me

[Falconspeed]

Thank you for the notice and the wise counsel.

[dayglored]

Right on analysis.

That said, it’s depressing how many otherwise intelligent people don’t stay up to date with patch releases.

(I won’t even start on the folks still running WinXP...) :-)

[CodeToad]

These buffer type problems are extremely difficult to ever get to execute with current processors as current processors will not execute code located in data segments.

[Swordmaker]

These buffer type problems are extremely difficult to ever get to execute with current processors as current processors will not execute code located in data segments.

Exactly. This was a problem maybe ten years ago or so, but not anymore. Thanks for validating that.

[Nuc 1.1]

Thanks for the info. Updated my iPad.