Apple releases emergency update to fix zero-day exploited in attacks

https://www.bleepingcomputer.com/news/apple/apple-releases-emergency-update-to-fix-zero-day-exploited-in-attacks/

by arkadiyt • 3 years ago

62 27 3 years ago

What about older OSes? Are they not vulnerable or simply ignored?

treesknees• 3 years ago

Apple only releases Rapid Security Response updates for the latest versions of its operating systems [1]. So any devices running iOS 16.4.X or MacOS 13.3.X won't see one, and anything before that didn't support Rapid Security Response updates. Unfortunately there's not enough information available to know if older releases are vulnerable.

[1] https://support.apple.com/en-us/HT201224

vaxman4• 3 years ago

Unfortunately there's not enough information available to know if older releases are vulnerable.

Assume YES.

vaxman4• 3 years ago

Hell, what about newer OSes ...like iOS 17 Beta? visionOS 1 Beta?

gumby2• 3 years ago

Betas don't need a rapid response; people running beta can wait.

Though for all you know this bug doesn't even exist in the newer versions. Or the mitigation was already in the beta but this rapid response required an extra day for testing as it is being shipped to users.

Rolcol• 3 years ago

Apple also released Safari 16.5.2 for Big Sur and Monterey to address this: https://support.apple.com/en-us/HT213826

jiveturkey• 3 years ago

https://arstechnica.com/gadgets/2022/10/apple-clarifies-secu...

I remember just after this announcement was the first super-critical update for ventura. It was about 31 days before older OS versions got the patch, even though they were identified as vulnerable at the time of the ventura update. :(

ratg133• 3 years ago

I’ve always been curious to know .. with all of the random 0-days in mobile operating systems (iOS, for example)

How do you know that an attacker is not persisting in the system if you click a bad link before a patch gets applied?

dmitrygr• 3 years ago

Persisting in the fs is much harder than just getting code execution. Not impossible (nothing is) but much harder (and thus likely less common), due to signature checking

badrabbit3• 3 years ago

You're assuming a click/tap is involved. Several iOS exploits are 0-click.

ratg133• 3 years ago

Your pedantry is noted, but this would not change the answer to the question at all.

Gigachad2• 3 years ago

Would be pretty difficult to find an exploit that avoids the boot chain attestation features. Good reason why a lot of exploits require you to reapply them every reboot.

mensetmanusman2• 3 years ago

This is interesting, it installs without a restart almost immediately.

urda• 3 years ago

My iPhone required a restart, but the whole process took less than 5 minutes.

mensetmanusman2• 3 years ago

Which device? ip14pm here

noxon• 3 years ago

My iPhone 14 pro max required a restart.

vb32• 3 years ago

that's interesting! most likely because it's just app update to safari. they should really allow built-in apps to get updated via App Store...

Gigachad2• 3 years ago

Why would it matter? They can deploy updates via the existing system instantly.

vb32• 3 years ago

looks like update has been pulled for now https://forums.macrumors.com/threads/apple-releases-rapid-se...

Apple releases emergency update to fix zero-day exploited in attacks

Related Stories