Apple watchOS up to 5.2.0 SQLite sql injection

Summaryinfo

A vulnerability was found in Apple watchOS up to 5.2.0. It has been rated as critical. Affected by this vulnerability is an unknown functionality of the component SQLite. The manipulation leads to sql injection. This vulnerability is documented as CVE-2019-8600. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Apple watchOS up to 5.2.0 (Smartwatch Operating System). It has been rated as critical. This issue affects an unknown function of the component SQLite. The manipulation with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. A maliciously crafted SQL query may lead to arbitrary code execution.

The weakness was released 05/13/2019 with CheckPoint as HT210122 as confirmed advisory (Website). The advisory is shared at support.apple.com. The identification of this vulnerability is CVE-2019-8600 since 02/18/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1505 for this issue. The advisory points out:

A memory corruption issue was addressed with improved input validation.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 371813 (Apple iCloud for Windows Prior to 7.12 Multiple Vulnerabilities(HT210125)).

Upgrading to version 5.2.1 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Entries connected to this vulnerability are available at VDB-134861, VDB-134862, VDB-134863 and VDB-134864. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Smartwatch Operating System

Vendor

• Apple

Name

• watchOS

Version

• 5.0
• 5.1
• 5.2.0

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion