iOS 12.3 security update

Apple released a security update for iPhones and iPads, 1OS 12.3, on May 13, 2013. You can subscribe to Apple security announcements at https://lists.apple.com/mailman/listinfo/security-announce/


APPLE-SA-2019-5-13-1 iOS 12.3

iOS 12.3 is now available and addresses the following:

AppleFileConduit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2019-8593: Dany Lisiansky (@DanyL931)

Contacts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to read restricted memory
Description: An input validation issue was addressed with improved
input validation.
CVE-2019-8598: Omer Gull of Checkpoint Research

CoreAudio
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted movie file may lead to
arbitrary code execution
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2019-8585: riusksk of VulWar Corp working with Trend Micro’s Zero
Day Initiative

Disk Images
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2019-8560: Nikita Pupyshev of Bauman Moscow State Technological
University

Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with system privileges
Description: A use after free issue was addressed with improved
memory management.
CVE-2019-8605: Ned Williamson working with Google Project Zero

Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to cause unexpected system
termination or read kernel memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2019-8576: Brandon Azad of Google Project Zero, unho Jang and
Hanul Choi of LINE Security Team

Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to cause unexpected system
termination or write kernel memory
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2019-8591: Ned Williamson working with Google Project Zero

Lock Screen
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
see the email address used for iTunes
Description: A logic issue was addressed with improved restrictions.
CVE-2019-8599: Jeremy Peña-Lopez (aka Radio) of the University of
North Florida

Mail
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted message may lead to a denial
of service
Description: An input validation issue was addressed with improved
input validation.
CVE-2019-8626: Natalie Silvanovich of Google Project Zero

Mail Message Framework
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A remote attacker may be able to cause arbitrary code
execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2019-8613: Natalie Silvanovich of Google Project Zero

MobileInstallation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to modify protected parts of the
file system
Description: A validation issue existed in the handling of symlinks.
This issue was addressed with improved validation of symlinks.
CVE-2019-8568: Dany Lisiansky (@DanyL931)

MobileLockdown
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to gain root privileges
Description: An input validation issue was addressed with improved
input validation.
CVE-2019-8637: Dany Lisiansky (@DanyL931)

Photos Storage
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2019-8617: an anonymous researcher

SQLite
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to gain elevated privileges
Description: An input validation issue was addressed with improved
memory handling.
CVE-2019-8577: Omer Gull of Checkpoint Research

SQLite
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A maliciously crafted SQL query may lead to arbitrary code
execution
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2019-8600: Omer Gull of Checkpoint Research

SQLite
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to read restricted memory
Description: An input validation issue was addressed with improved
input validation.
CVE-2019-8598: Omer Gull of Checkpoint Research

SQLite
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed by removing the
vulnerable code.
CVE-2019-8602: Omer Gull of Checkpoint Research

Status Bar
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: The lock screen may show a locked icon after unlocking
Description: The issue was addressed with improved UI handling.
CVE-2019-8630: Jon M. Morlan

StreamingZip
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to modify protected parts of the
file system
Description: A validation issue existed in the handling of symlinks.
This issue was addressed with improved validation of symlinks.
CVE-2019-8568: Dany Lisiansky (@DanyL931)

sysdiagnose
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2019-8574: Dayton Pidhirney (@_watbulb) of Seekintoo (@seekintoo)

WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may result in the
disclosure of process memory
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2019-8607: Junho Jang and Hanul Choi of LINE Security Team

WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2019-6237: G. Geshev working with Trend Micro Zero Day
Initiative, Liu Long of Qihoo 360 Vulcan Team
CVE-2019-8571: 01 working with Trend Micro’s Zero Day Initiative
CVE-2019-8583: sakura of Tencent Xuanwu Lab, jessica (@babyjess1ca_)
of Tencent Keen Lab, and dwfault working at ADLab of Venustech
CVE-2019-8584: G. Geshev of MWR Labs working with Trend Micro Zero
Day Initiative
CVE-2019-8586: an anonymous researcher
CVE-2019-8587: G. Geshev working with Trend Micro Zero Day Initiative
CVE-2019-8594: Suyoung Lee and Sooel Son of KAIST Web Security &
Privacy Lab and HyungSeok Han and Sang Kil Cha of KAIST SoftSec Lab
CVE-2019-8595: G. Geshev from MWR Labs working with Trend Micro Zero
Day Initiative
CVE-2019-8596: Wen Xu of SSLab at Georgia Tech
CVE-2019-8597: 01 working with Trend Micro Zero Day Initiative
CVE-2019-8601: Fluoroacetate working with Trend Micro’s Zero Day
Initiative
CVE-2019-8608: G. Geshev working with Trend Micro Zero Day Initiative
CVE-2019-8609: Wen Xu of SSLab, Georgia Tech
CVE-2019-8610: Anonymous working with Trend Micro Zero Day Initiative
CVE-2019-8611: Samuel Groß of Google Project Zero
CVE-2019-8615: G. Geshev from MWR Labs working with Trend Micro’s
Zero Day Initiative
CVE-2019-8619: Wen Xu of SSLab at Georgia Tech and
Hanqing Zhao of Chaitin Security Research Lab
CVE-2019-8622: Samuel Groß of Google Project Zero
CVE-2019-8623: Samuel Groß of Google Project Zero
CVE-2019-8628: Wen Xu of SSLab at Georgia Tech and
Hanqing Zhao of Chaitin Security Research Lab

Wi-Fi
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A device may be passively tracked by its WiFi MAC address
Description: A user privacy issue was addressed by removing the
broadcast MAC address.
CVE-2019-8620: David Kreitschmann and Milan Stute of Secure Mobile
Networking Lab at Technische Universität Darmstadt

Additional recognition

Clang
We would like to acknowledge Brandon Azad of Google Project Zero for
their assistance.

CoreFoundation
We would like to acknowledge Vozzie and Rami and m4bln, Xiangqian
Zhang, Huiming Liu of Tencent’s Xuanwu Lab for their assistance.

Kernel
We would like to acknowledge Brandon Azad of Google Project Zero and
an anonymous researcher for their assistance.

MediaLibrary
We would like to acknowledge Angel Ramirez and Min (Spark) Zheng,
Xiaolong Bai of Alibaba Inc. for their assistance.

MobileInstallation
We would like to acknowledge Yiğit Can YILMAZ (@yilmazcanyigit) for
their assistance.

Safari
We would like to acknowledge Ben Guild (@benguild) for their
assistance.

Installation note:

This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer’s Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/

iTunes and Software Update on the device will automatically check
Apple’s update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don’t Install
will present the option the next time you connect your iOS device.

The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.

To check that the iPhone, iPod touch, or iPad has been updated:

* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be “iOS 12.3”.

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

April 2019: Web browsers

Strait Macintosh User’s Group (SMUG)
April 2, 2019

Meeting: 7:00 p.m. to 8:00 p.m. at St. Luke’s Episcopal Church, Sequim

Meeting called to order by President Sabrina Davis and Vice President Lawrence Charters.

Two outstanding board positions, Treasurer and Secretary, remained to be filled. By unanimous vote, Analiss Schutzman was elected Treasurer and Kathleen Charters elected Secretary.

There was a discussion of the need for better communications. The SMUG forum had a note that the meeting was canceled and the organization dissolved, but at the last meeting in December, no such motions were entertained, and the February meeting was canceled due to show. Most attendees found out about the meeting either through direct contact with the President or Vice President, or through an announcement posted on Next Door (https://nextdoor.com/).

At present, there are no plans to charge for membership in 2019. The domain name and Internet hosting fees for the website are paid through 2019, with the only remaining expense being room rental for meetings. The membership voted to pay the room rental on a yearly basis, and to reimburse Sabrina for paying out of pocket for the April meeting rental.

It was also agreed that meetings would continue every other month in Sequim. If attendance and conditions warrant, more frequent meetings may be adopted.

Meeting topic: Web browsers

Lawrence Charters did a live, interactive presentation on the World Wide Web in general, with a particular emphasis on web security and privacy. The web began in 1990, with an experiment at the European Organization for Nuclear Research (CERN, from the French Conseil européen pour la recherche nucléaire). Tim Berners-Lee developed a prototype web server on a NeXT computer, and it started serving out pages over the Internet in 1991. It rapidly eclipsed or replaced Gopher, FTP, newsgroups, and other Internet sources of information, and now the most widely used communications medium in history.

At its foundation, the web is based on text. As an example, this curl command (curl is built in to macOS) will fetch the opening page from the National Ocean Service website:

Capturing the first page of the National Ocean Service site using curl.
Capturing the first page of the National Ocean Service website using curl and macOS Terminal. Click on image for a larger view.

These elements of code are assembled by your web browser (Safari, Chrome, Firefox, etc.) into something (usually) much more useful: shopping sites, encyclopedias, dating sites, travel maps, etc.

Incidentally, email messages — even ones with graphics and sound and video — are also based on text. The text is assembled by your email client into discrete messages that look more like paper-based letters.

Because of abusive practices on the web, Google and Apple have been pushing hard for increased security and privacy. Safari on your Mac shows a lock icon when visiting an encrypted site; Google will show a lock in the location bar, and if visiting an insecure site, will display “Not Secure” right next to the URL.

It doesn’t matter if a site “sells” something; Apple and Google, and more recently Microsoft, want you to visit only encrypted sites. An unencrypted site can be easily compromised to, among other things, pass malware to your computer, or be used to “impersonate” a site.

With an encrypted site, anything you send between your device and the website is encrypted; it can’t be intercepted and read, or intercepted and modified. Google Chrome and Apple Safari also check the encryption certificates of a site to ensure that a) the certificate is valid and b) it is for the site it claims to represent.

Apple and Google also maintain a blacklist of sites that are known to be harmful. Apple does this through Gatekeeper, which is a combination of technologies that, among other things, periodically downloads a list of domains that your will refuse to visit. Google does this dynamically; every Chrome URL request checks with Google’s list of blacklisted sites.

Because of the security risks, Google also “downrates” sites that are not encrypted, pushing them down their rating results to discourage visits. Similarly, Apple does not allow iOS apps to make unencrypted web connections. These and other measures have resulted in a very rapid change to make encrypted websites (https and not http) the default on the web. There are still hundreds of millions of unencrypted sites; avoid them.

The easiest way to protect your Mac or iOS device: stay current with system and security updates.

In response to a question, Lawrence explained one major security difference between iOS devices and Android devices. Apple directly updates iOS (iPhone, iPad, iPod) devices. In the Android world, with one major exception, you need to go through your phone company. What this means: if you are on T-Mobile, or AT&T, or Verizon, or whatever, you can update your iPhone by just asking your device to do a software update, or responding to a prompt sent by Apple. But with almost all Android devices, the updates come directly from Verizon, T-Mobile, AT&T, etc., and while the device might theoretically qualify for a security update, the phone companies generally will not provide updates; they expect you to buy a new phone if you want an update. The exception: Google updates their Pixel devices directly.

Lawrence strongly recommended that everyone use long (15 characters or more), unique passwords for everything on the Internet. No password, for anything, should be reused somewhere else. To keep track of the passwords, use Apple’s Key Chain (free, and shared between iOS and Mac) or 1Password (paid, but much easier to understand and organize).

Don’t worry about “complex” passwords (use one upper case, one lower case, one symbol, one number) password. The important thing is to make them unique, and long; the longer the better. Spaces, by the way, count as a character.

Good: Kim Jong-un is a nutcase

Too short, and much harder to type correctly: K1mJ0Ng-nUTs

Passwords that are hard to type are easy to compromise because people tend to reuse them, or leave notes reminding themselves how to type them.

There were many more questions and topics than time available, so at the June meeting we will continue with:

Web security and privacy

While there are no privacy laws in the US, the European Union has imposed fairly demanding privacy laws, and as US companies want to do business with the EU, improved privacy is rapidly improving on major US websites. But individuals ultimately have the most control over their own privacy and security. We’ll talk about that in June.