Kernels can be exploited and iCloud account user information leaked due to the security flaws.
Zimperium has released the public details of security vulnerabilities affecting both the Android and iOS mobile operating systems to the public.
The three N-day security flaws, which are bugs that are already known — unlike zero-days — were both patched earlier this year.
However, by revealing the technical details to the general public and sharing the information prior with Zimperium’s Handset Alliance (ZHA) — of which Samsung, Telstra and BlackBerry are members, among others — this will hopefully prompt handset vendors to ensure patches released by Apple and Google are rolled out quickly, if they have not already been made available.
The first flaw, which at the time of writing has not been issued a CVE number, is an information disclosure issue which impacts Apple’s iCloud storage service. Affecting iOS version 10.3 and below, the vulnerability occurs due to a lack of sandbox checks.
The XPC service com.apple.coreservices.appleid.authentication could be accessed by any application on iOS and attackers could exploit the issue by sending a message containing a “command” key to the service. If the value was set to 0x130, 0x500 or 0x510, information about the user’s iCloud was exposed, such as phone numbers, names, the device serial number, as well as all emails associated with the iCloud account.
The second vulnerability, CVE-2016-2434, is a privilege escalation bug resolved in an Android security bulletin earlier this month.
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
