Apple iOS/iPadOS up to 14.8 Screen Recording access control

Summaryinfo

A vulnerability was found in Apple iOS and iPadOS. It has been rated as critical. The impacted element is an unknown function of the component Screen Recording. This manipulation causes access control. The identification of this vulnerability is CVE-2024-27869. The attack can only be executed locally. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic was found in Apple iOS and iPadOS. Affected by this vulnerability is an unknown function of the component Screen Recording. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect integrity. The summary by CVE is:

The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to record the screen without an indicator.

The advisory is shared at support.apple.com. This vulnerability is known as CVE-2024-27869 since 02/26/2024. The exploitation appears to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 09/18/2024). MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 15 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Smartphone Operating System

Vendor

• Apple

Name

• iOS
• iPadOS

Version

• 10.15.0
• 12.4.7
• 12.5.2
• 12.5.3
• 12.7
• 13.0
• 13.0.1
• 13.1
• 13.1.1
• 13.2
• 13.3
• 13.3.1
• 13.4
• 13.4.1
• 13.5
• 13.5.1
• 13.6
• 13.7
• 14.0
• 14.2
• 14.3
• 14.4
• 14.4.1
• 14.4.2
• 14.5
• 14.5.0
• 14.5.1
• 14.6
• 14.7
• 14.7.1
• 14.8

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion