A vulnerability was found in Apple iOS up to 12.4.1 (Smartphone Operating System). It has been declared as critical. Affected by this vulnerability is an unknown part of the component Siri. The manipulation as part of a Audio File leads to a privileges management vulnerability (Self). The CWE definition for the vulnerability is CWE-269. The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability.

The bug was discovered 05/15/2019. The weakness was published 10/10/2019 by Marc Ruef with scip AG as iPhone Siri Self-Reference Exploiting as confirmed blog post (Website). The advisory is shared at scip.ch. The public release has been coordinated with Apple. This vulnerability is known as CVE-2019-25071. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue. The advisory points out:

It happened when playing a YouTube video on an iPhone XS with iOS 12.3.1; suddenly, Siri piped up. It was as if she had heard the command Hey, Siri and responded. But there was no such command in the video. At first, we thought it might be a coincidence.

A public exploit has been developed by Marc Ruef and been published immediately after the advisory. It is possible to download the exploit at youtube.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 132 days. During that time the estimated underground price was around $25k-$100k. The real existence of this vulnerability is still doubted at the moment. Apple claims, that after examining the report they do not see any actual security implications.

Upgrading to version 13.0 eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability. The blog post contains the following remark:

In accordance with the responsible disclosure process, we made prior email contact with Apple on July 10, 2019 and told them about our discovery. (…) The next day, the Apple Security Team replied. They indicated that the facts were correct, but they did not consider it a risk.

Productinfo

Type

• Smartphone Operating System

Vendor

• Apple

Name

• iOS

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

Video

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion