Reprinted from TidBITS by permission; reuse governed by Creative Commons
license BY-NC-ND 3.0. TidBITS has offered years of thoughtful commentary
on Apple and Internet topics. For free email subscriptions and access to the
entire TidBITS archive, visit http://www.tidbits.com/


       OS Security UpdatesAddress Three More Exploited Vulnerabilities

   Adam Engst

   Here we go again. Bill Marczak of [1]The Citizen Lab at the University
   of Toronto and Maddie Stone of Google's [2]Threat Analysis Group have
   identified three more Apple-focused security vulnerabilities that are
   actively being exploited. Although there's no corresponding blog post
   that clarifies, as with the last time this happened (see '[3]OS
   Security UpdatesPlug Image and Wallet Vulnerabilities Exploited by
   Pegasus Spyware,' 7 September 2023), it seems likely that these
   vulnerabilities are being used by the NSO Group's Pegasus spyware.

   One of the vulnerabilities allows arbitrary code execution while
   processing Web content, another allows a malicious app to bypass
   signature validation, and the third could allow a local attacker to
   elevate their privileges. To me (backed up by Security Editor Rich
   Mogull), that sounds like a full exploit chain.

   Apple has released updates for the two most recent versions of iOS,
   iPadOS, and watchOS, plus the two versions of macOS before macOS 14
   Sonoma, which is due out next week. (You won't be offered the updates
   for iOS 17.0.1, iPadOS 17.0.1, or watchOS 10.0.1 if you were receiving
   beta updates; turn them off to see the latest.) Install everything
   using Software Update.

   The release notes are nearly identical for all the updates:
     * i[4]OS 17.0.1 and iPadOS 17.0.1
     * [5]iOS 16.7 and iPadOS 16.7
     * [6]watchOS 10.0.1
     * [7]watchOS 9.6.3
     * [8]macOS Ventura 13.6
     * [9]macOS Monterey 12.7

   On the assumption that these vulnerabilities are being exploited by
   Pegasus and not something that targets a broader swath of users, I
   suggest that most people need not update immediately but should do so
   as soon as is convenient. For instance, take advantage of the Update
   Tonight option if possible. On my iPhone 14 Pro, installing the iOS
   17.0.1 update took about 13 minutes.

   Be aware that Apple says exploits targeting these vulnerabilities may
   have been used against versions of iOS before iOS 16.7. That may mean
   anyone whose device can't upgrade past iOS 15 or iPadOS 15 remains
   vulnerable. Again, for most people, that's probably not cause for
   concern, but if you're worried about being targeted by a nation-state,
   get a new iPhone, upgrade to the latest version of iOS, and turn on
   [10]Lockdown Mode.

References

   Visible links
   1. https://citizenlab.ca/
   2. https://blog.google/threat-analysis-group/
   3. https://tidbits.com/2023/09/07/%ef%a3%bfos-security-updates-plug-image-and-wallet-vulnerabilities/
   4. https://support.apple.com/kb/HT213926
   5. https://support.apple.com/kb/HT213927
   6. https://support.apple.com/kb/HT213928
   7. https://support.apple.com/kb/HT213929
   8. https://support.apple.com/kb/HT213931
   9. https://support.apple.com/kb/HT213932
  10. https://support.apple.com/en-ca/HT212650

   Hidden links:
  11. https://tidbits.com/wp/../uploads/2023/09/iOS-17.0.1-scaled.jpg

.