MA-970.092023: MyCERT Advisory - Apple Releases Security Updates for iOS and macOS

  • 16 Sep 2023
  • Advisory
  • apple, ios, macos, ipados, tvos, update

1.0 Introduction

Recently, Apple has released security updates to address a vulnerability in multiple products.

2.0 Impact
A cyber threat actor could exploit this vulnerability to take control of an affected device.

3.0 Affected Products

4.0 Recommendations
MyCERT encourages users and administrators to review the following advisories and apply the necessary updates.

Kindly refer to the following:

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References
https://www.cisa.gov/news-events/alerts/2023/09/12/apple-releases-security-updates-ios-and-macos

MA-947.062023: MyCERT Advisory - Apple Releases Security Updates for Multiple Products

  • 27 Jun 2023
  • Advisory
  • apple, iOS, iPadOS, macOS, watchOS, update, security

1.0 Introduction

Recently, Apple has released security updates to address vulnerabilities in multiple products.

2.0 Impact
An attacker could exploit some of these vulnerabilities to take control of an affected device:

  • CVE-2023-32434: An integer overflow vulnerability in the Kernel that could be exploited by a malicious app to execute arbitrary code with kernel privileges.
  • CVE-2023-32435: A memory corruption vulnerability in WebKit that could lead to arbitrary code execution when processing specially crafted web content.

3.0 Affected Products

4.0 Recommendations
MyCERT encourages users and administrators to review the following advisories and apply the necessary updates.

Kindly refer to the following URLs:

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

To update, please refer:

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References

MA-918.042023: MyCERT Advisory - Apple Releases Security Updates for Multiple Products

  • 04 Apr 2023
  • Advisory
  • apple, security, update, iOS, iPadOS, macOS, tvOS, watchOS, safari

1.0 Introduction
Recently, Apple has released security updates to address vulnerabilities in multiple products.

2.0 Impact
An attacker could exploit some of these vulnerabilities to take control of an affected device.

3.0 Affected Products

4.0 Recommendations
MyCERT encourages users and administrators to review the following advisories and apply the necessary updates.

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References

MA-913.032023: MyCERT Advisory - Apple Releases Security Updates for Multiple Products

  • 14 Mar 2023
  • Advisory
  • apple, ios, ipados, safari, macos, update, security

1.0 Introduction

Recently, Apple has released security updates to address vulnerabilities in multiple products.

2.0 Impact
An attacker could exploit some of these vulnerabilities to take control of an affected device.

3.0 Affected Products

4.0 Recommendations
MyCERT encourages users and administrators to review the Apple security updates page for the following products and apply the necessary updates as soon as possible:

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References

MA-910.022023: MyCERT Advisory - Apple Releases Security Updates for Multiple Products

  • 17 Feb 2023
  • Advisory
  • apple, security, updates, iOS, macOS, iPadOS, watchOS, Safari

1.0 Introduction

Recently, Apple has released security updates to address vulnerabilities in multiple products.

2.0 Impact
An attacker could exploit these vulnerabilities to take control of an affected device.

3.0 Affected Products

•   Safari 16.3.1
•   iOS 16.3.1 and iPadOS 16.3.1
•   macOS 13.2.1

4.0 Recommendations
MyCERT encourages users and administrators to review the Apple security updates page for the following products and apply the necessary updates as soon as possible:
•   Safari 16.3.1 - https://support.apple.com/kb/HT213638
•   iOS 16.3.1 and iPadOS 16.3.1 - https://support.apple.com/kb/HT213635
•   macOS 13.2.1 - https://support.apple.com/kb/HT213633

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References
https://www.cisa.gov/uscert/ncas/current-activity/2023/02/14/apple-releases-security-updates-multiple-products

MA-896.122022: MyCERT Advisory - Apple Releases Security Updates for Multiple Products

  • 15 Dec 2022
  • Advisory
  • apple, iOS, iPadOS, macOS, tvOS, watchOS, safari, update, software, security

1.0 Introduction

Apple has released security updates to address vulnerabilities in multiple products.

2.0 Impact
An attacker could exploit some of these vulnerabilities to take control of an affected device.

3.0 Affected Products

  • Safari 16.2
  • iCloud for Windows 14.1
  • macOS Monterey 12.6.2
  • macOS Big Sur 11.7.2
  • tvOS 16.2
  • watchOS 9.2
  • iOS 15.7.2 and iPadOS 15.7.2
  • iOS 16.2 and iPadOS 16.2
  • macOS Ventura 13.1

4.0 Recommendations
MyCERT encourages users and administrators to review the Apple security updates page for the following products and apply the necessary updates as soon as possible.

The Apple security updates page is available at:
https://support.apple.com/en-us/HT201222

Generally, MyCERT advises the users of these devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please get in touch with MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References 

MA-878.102022: MyCERT Advisory - Apple Releases Security Updates for Multiple Products

  • 27 Oct 2022
  • Advisory
  • apple, safari, iPhone, iPad, iOS, iPadOS, macOS, tvOS, watchOS, security, update

1.0 Introduction
Recently, Apple has released security updates to address vulnerabilities in multiple products.

2.0 Impact
An attacker could exploit some of these vulnerabilities to take control of an affected device. 

3.0 Affected Products
•    Safari
•    iOS and iPadOS 
•    macOS
•    tvOS
•    watchOS

4.0 Recommendations
MyCERT encourages users and administrators to review the Apple security updates page for the following products and apply the necessary updates as soon as possible: 

•    Safari 16.1
•    iOS 16.1 and iPadOS 16 
•    macOS Big Sur 11.7.1 
•    macOS Monterey 12.6.1
•    macOS Ventura 13 
•    tvOS 16.1 
•    watchOS 9.1 

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References
https://www.cisa.gov/uscert/ncas/current-activity/2022/10/26/apple-releases-security-updates-multiple-products

MA-860.092022: MyCERT Advisory - Apple Releases Security Updates for Multiple Products

  • 15 Sep 2022
  • Advisory
  • Apple, iOS, iPadOS, macOS, iPhone, iPad, iPod, MacBook, update, security

1.0 Introduction
Recently, Apple has released security updates to address vulnerabilities in multiple products. 

2.0 Impact
An attacker could exploit some of these vulnerabilities to take control of an affected device.

3.0 Affected Products
The affected Apple products are iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).

4.0 Recommendations
Users and administrators are recommended to review the Apple security updates page for the following products and apply the necessary updates as soon as possible:
• Safari 16
• iOS 16
• macOS Monterey 12.6
• macOS Big Sur 11.7
• iOS 15.7 
• iPadOS 15.7

Kindly refer to the following URL:
https://support.apple.com/en-us/HT201222

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0 References
https://www.cisa.gov/uscert/ncas/current-activity/2022/09/13/apple-releases-security-updates-multiple-products
https://support.apple.com/en-us/HT201222
https://support.apple.com/en-us/HT213442
https://support.apple.com/en-us/HT213446
https://support.apple.com/en-us/HT213444
https://support.apple.com/en-us/HT213443
https://support.apple.com/en-us/HT213445
 

MA-850.082022: MyCERT Advisory - Apple Releases Security Update for iOS, iPadOS, macOS and Safari

  • 20 Aug 2022
  • Advisory

1.0 Introduction

Apple has released security updates to address vulnerabilities in iOS devices.

No.CVEBug Type/ImpactAffected DevicesSeverity
1CVE-2022-32893Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited

iOS

iPadOS

macOS

Safari

Critical
2CVE-2022-32894An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited

iOS

iPadOS

macOS

Critical

2.0 Impact
Exploitation of these vulnerabilities could potentially cause arbitrary code execution and acquiring administrative privilege which are considered as critical severity. On the unpatched devices attacker can remotely:

  • Monitor any running apps
  • Upload and execute apps that are not from App Store
  • Access all files and folders on the device
  • Change devices security settings
  • Retrieve GPS location
  • Take screenshots 
  • Use the device's cameras and take photo
  • Activate and record from the microphone
  • Copy messages
  • Track your browsing history

and more.

3.0 Affected Products
3.1 iOS and iPadOS devices that support iOS 15 with iOS 15.6 and below version installed

  • iPhone 6s and later
  • iPad Pro (all models)
  • iPad Air 2 and later
  • iPad 5th generation and later
  • iPad mini 4 and later
  • iPod touch (7th generation)

3.2 macOS devices that support macOS Monterey with macOS 12.5 and below version installed on these devices

  • iMac - Late 2015 and later
  • iMac Pro - 2017 and later
  • MacBook Air - Early 2015 and later
  • MacBook Pro - Early 2015 and later
  • Mac Pro - Late 2013 and later
  • Mac mini - Late 2014 and later
  • MacBook - Early 2016 and later

3.3 Safari version 15.6 or below running on macOS Big Sur and macOS Catalina on these devices

  • 2015 and earlier MacBook
  • 2013 and earlier MacBook Air
  • Late 2013 and earlier MacBook Pro
  • 2014 and earlier iMac
  • 2017 and earlier iMac Pro
  • 2014 and earlier Mac mini
  • 2013 and earlier Mac Pro

4.0 Recommendations
We encourage users and administrators to review the Apple security updates website and apply the necessary updates:

To update, please refer:

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0  References

MA-689.122017: MyCERT Advisory - Apple MacOS Sierra Vulnerability

  • 01 Dec 2017
  • Advisory
1.0 Introduction
Apple has released a supplemental security update to address a vulnerability in macOS High Sierra 10.13. The flaw can allow a local or remote user of a MacOS High Sierra system to obtain root privileges without requiring credentials.


2.0 Impact
A local or remote user of a MacOS High Sierra system can obtain root privileges without requiring credentials and could exploit this vulnerability to take control of an affected system. Any system that has the root account enabled (e.g. via testing for this vulnerability) may also expose the root account for use with remote administrative capabilities, such as the built-in "Screen Sharing" or "Remote Management" capabilities.


3.0 Affected Product
•    macOS High Sierra 10.13.1


4.0 Recommendation    
MyCERT advise users to always lock their computers, enable strong passwords following password management best practices for their accounts and never leave their computers unattended.

MyCERT highly recommended users and administrators to review and adhere with the information provided at the below URL and apply the necessary update.
•    http://www.kb.cert.org/vuls/id/113765
•    https://support.apple.com/en-us/HT208315

Please refer to the workaround below if you encounter the problem with installing the security updates by Apple.

1.    As a user with administrative privileges, launch Terminal
2.    Type sudo passwd -u root
3.    Enter a strong password

For more details on password settings, please refer to the information
provided at the URL below.
•    https://support.apple.com/en-us/HT204012
•    https://9to5mac.com/2017/11/28/how-to-set-root-password/

Generally, MyCERT advises the users of this product to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.


For further enquiries, please contact MyCERT through the following channels:
E-mail: [email protected] or [email protected]
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Handphone: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: https://www.mycert.org.my
Twitter: http://www.twitter.com/mycert
Facebook: http://www.facebook.com/mycert.org.my
Cyber999 Mobile Apps: IOS Users or Android Users
 

5.0 References
•    https://www.us-cert.gov/ncas/current-activity/2017/11/29/Apple-Releases-Security-Update-macOS-High-Sierra
•    http://www.kb.cert.org/vuls/id/113765
•    https://www.jpcert.or.jp/english/at/2017/at170045.html
•    https://support.apple.com/en-us/HT204012
•    https://9to5mac.com/2017/11/28/how-to-set-root-password/
 
Showing 1-10 of 10 items.
(not set)
(not set)
(not set)
(not set)
(not set)
(not set)
(not set)
(not set)
(not set)
(not set)