Apple Patches Three Zero-Day Security Vulnerabilities Exploited in the Wild
Apple, a tech behemoth, has recently come under the spotlight, not for its innovative features, but for vulnerabilities in its software. On Thursday, Apple rolled out crucial security patches for a myriad of its devices after the discovery of three zero-day vulnerabilities, which had been exploited in the wild.
The zero-day vulnerabilities, deemed exceptionally dangerous as they were being exploited before Apple had the opportunity to rectify them, existed in the heart of Apple’s software ecosystem:
- WebKit browser engine (CVE-2023-41993): WebKit powers Apple’s Safari browser. The flaw here allowed cyber attackers to execute arbitrary codes through maliciously crafted web pages, turning an innocuous web browsing session into a potential minefield.
- Security Framework (CVE-2023-41991): This vulnerability permitted attackers to sidestep signature validation through rogue apps, undermining the stringent app validation process Apple prides itself on.
- Kernel Framework (CVE-2023-41992): Found in the core of the operating system, this vulnerability could be a golden ticket for attackers. It gives room for local attackers to escalate their privileges in the system, potentially gaining far-reaching access.
Apple, in its transparency, revealed: “Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.” A broad spectrum of devices, both old and new, are impacted:
- iPhones starting from iPhone 8
- iPads from the 5th generation mini onward
- Macs with macOS Monterey and subsequent versions
- Apple Watch Series 4 and its successors
The vulnerabilities were not left hidden, thanks to the keen eyes of Bill Marczak from the Citizen Lab at The University of Toronto’s Munk School, and Maddie Stone of Google’s Threat Analysis Group. Both Citizen Lab and the Google Threat Analysis Group have a commendable history of uncovering zero-day vulnerabilities, particularly those employed in targeted spyware attacks on high-profile individuals, like journalists and political dissidents.
Apple has fixed the three zero-day bugs in macOS 12.7/13.6, iOS 16.7/17.0.1, iPadOS 16.7/17.0.1, and watchOS 9.6.3/10.0.1. While Apple has been somewhat tight-lipped about the precise details of the wild exploitations of these vulnerabilities, users are urged to update their devices immediately.
