Apple iOS 10/10.1 on iPhone Lockscreen Backup improper authentication

Summaryinfo

A vulnerability categorized as critical has been discovered in Apple iOS 10/10.1 on iPhone. The affected element is an unknown function of the component Lockscreen. Executing a manipulation can lead to improper authentication (Backup). The attack is restricted to local execution. Moreover, an exploit is present. It is advised to implement the suggested workaround.

Detailsinfo

A vulnerability classified as critical was found in Apple iOS 10/10.1 on iPhone (Smartphone Operating System). This vulnerability affects an unknown functionality of the component Lockscreen. The manipulation with an unknown input leads to a improper authentication vulnerability (Backup). The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was disclosed 11/17/2016 by Benjamin Kunz Mejri as VL-ID 2012 / 648680301 as confirmed advisory (Website). The advisory is available at vulnerability-lab.com. The vendor was not involved in the coordination of the public release. Local access is required to approach this attack. No form of authentication is required for a successful exploitation. Technical details are unknown but a public exploit is available. The advisory points out:

On investigation with the 2. vulnerability we identified another very strange vulnerability. When processing to request via Voice Over permanently the contact list by usage of a glitch, it can happen that the device is that irritated that is shows you some really private information. Within the last year i deleted several of my old contacts because of they did switch to another numbers, during the investigate my employee was all time seeing me reproduce the issue and asked me one time ... have you not deleted those accounts about 1 year ago permanently. I was watching into the sim contacts, the phone contacts and checked as well the icloud sync. At that moment we came to that point, were we was reading sensitive device information that stores in the cloud as well all the deleted entries.

A public exploit has been developed by Benjamin Kunz Mejri and been published immediately after the advisory. It is possible to download the exploit at vulnerability-lab.com. It is declared as proof-of-concept. As 0-day the estimated underground price was around $25k-$100k. The advisory illustrates:

The problem occurs mainly when process to push `.` or `space`button with a contact list glitch on voice over. In the most cases the information shows you the context that is illegal requested in the formular search entry but in case of our issue the device shows permanently deleted account information of the cloud that should not be stored anymore at all.

The best possible mitigation is suggested to be Workaround.

Additional details are provided at seclists.org. The entries VDB-93679, VDB-93680 and VDB-93681 are pretty similar. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Smartphone Operating System

Vendor

• Apple

Name

• iOS

Version

• 10
• 10.1

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion