CVE-2020-9992 Apple iOS High-Severity Privilege-Escalation Vulnerability
By Kashia Ingraham on October 13, 2020
Introduction
On September 16, 2020 International Business Machines (IBM) X-Force reported high-severity vulnerability with a Common Vulnerability Scoring System (CVSS) score of 7.3 out of 10 impacting iPhone 6s and newer models devices. The privilege-escalation vulnerability could be executed by tricking a target to open a specially crafted file [1].
Vulnerability
The vulnerability is tied to Apples developer toolset called Xcode. This toolset is for creating apps for Apple products. “Xcode brings user interface design, coding, testing, debugging, and submitting to the App Store all into a unified workflow” [2]. The bug was found in the Xcode Versions 11.7 allowing “a remote authenticated attacker to execute arbitrary code on the system, is caused by an error in an unknown IDE Device Support component” [3]. An attacker needs to be in a “privileged network position” to piggyback on this weakness with low privileges to exploit the flaw [4].
Impact
With low privileges to gain access, it can be easy to trick a target in opening a crafted file and exploit with arbitrary code towards a paired device in the debug session within the network [3]. Impacting all Apple users that have the follow devices mentioned with an older version.
Mitigation
Apple released a patch that addresses the issues by encrypting the communications over the network with devices running on iOS 14, iPadOS 14, tvOS 14, and watchOS7[5].
Relevance
Apple products are one of the topmost used technology devices. A vulnerability giving an attacker with low privileges to gain access to such devices becomes worry some. Many users tend to store their sensitive information on said devices, causing a violation of privacy.
References
[1] Threat Post, “Apple Bug Allows Code Execution on iPhone, iPad, iPod”, September 17, 2020. https://threatpost.com/apple-bug-code-execution-iphone/159332/
[2] Apple Support, “Xcode”, retrieved September 22, 2020. https://developer.apple.com/support/xcode/
[3] IBM X-force, “Apple Xcode code execution”, September 16, 2020.
https://exchange.xforce.ibmcloud.com/vulnerabilities/188334
[4] Mac Security, “Apple patches a critical privilege escalation flaw in iOS and iPadOS”, September 21, 2020. https://macsecurity.net/view/428-ios-ipados-14-fixes-high-severity-flaw
[5] Apple Support, “About the security content of Xcode 12.0”, September 16, 2020.
https://support.apple.com/en-us/HT211848