Apple has released iOS 17.0.1 and iPadOS 17.0.1, just days after the latest operating system was launched with much fanfare. This emergency iPhone update, and one which all iPhone and iPad users should apply as soon as is possible, comes with a critical warning. The security update addresses three critical vulnerabilities, and Apple warns it is aware of reports that the trio may have been actively exploited against versions of the iPhone operating system before iOS 16.7. If you are getting your new iPhone 15, iPhone 15 Plus, iPhone 15 Pro or iPhone 15 Pro Max at launch, you will need to update the operating system immediately.
What Is Known About The Three iOS Security Vulnerabilities?
As always, Apple has released very little detail about any of these iOS vulnerabilities, or the exploits using them. This is no surprise as Apple delays such detail until as many users as possible have had the chance to update their devices so as to prevent other attackers from producing exploits.
CVE-2023-41992
What is known at this stage is that credit for the discovery of CVE-2023-41992 is given to Bill Marczak of The Citizen Lab at The University of Toronto’s Munk School and Maddie Stone of Google’s Threat Analysis Group. This is a kernel vulnerability that could enable an attacker to elevate privileges.
CVE-2023-41991 And CVE-2023-41993
The same two security researchers are also credited with disclosing both CVE-2023-41991 and CVE-2023-41993. The first of these involves a certificate validation issue and successful exploitation cabin enable an attacker to bypass such validation using a malicious app. The latter vulnerability is within WebKit and the act of processing content could lead arbitrary code execution.
CVE-2023-41991 and CVE-2023-41992 also impact Apple Watch users and an emergency security update to watchOS 10.0.1 is also now available.
Update To iOS 17.0.1 Now
Given that all three of these vulnerabilities are known to have been exploited already, it is imperative that users update to the patched versions of iOS, iPadOS and watchOS as soon as possible. iPhone users should head to Settings|General|Software Update to download iOS 17.0.1.
Devices that are impacted by these already exploited vulnerabilities are: iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, iPad mini 5th generation and later.
Read the full article here
