Apple patches iOS 12 after hackers exploit WebKit Engine flaws

The emergency patch addresses two bugs abused to launch remote code execution attacks

Apple has released an out-of-band security fix to address two zero-day vulnerabilities in iOS 12.5.3 that hackers are actively exploiting to launch remote code execution attacks. 

The two flaws under scrutiny are CVE-2021-30761 and CVE-2021-30762, which both lie in the open source WebKit browser rendering engine used by Apple to power Safari, as well as all iOS web browsers. It’s also used by many other apps across the Apple ecosystem on various devices.

Apple has patched these two flaws with iOS version 12.5.4, alongside a fix for a memory corruption issue in ASN.1 decoder, tracked as CVE-2021-30737. Abstract Syntax Notation One, or ASN.1, is a standard interface language for defining data structures that can be serialised and deserialised in a cross-platform way.

The first of the two WebKit flaws, CVE-2021-30761, is also a memory corruption issue that can be exploited to execute code remotely when processing malicious web content. 

The second, CVE-2021-30762, is a use-after-free issue that can also be exploited to launch remote code execution attacks when processing malicious content. 

They’ve been fixed with “improved state management” and “improved memory management” respectively.  

These two are only the latest flaws to affect Apple’s WebKit browser engine that hackers have exploited since the start of the year. In total, Apple has patched seven WebKit-related flaws since January 2021, across various devices. 

Related Resource

Security awareness training strategies for account takeover protection

Why you need an inside-the-perimeter strategy for internal threats

Security awareness training strategies for account takeover protection - whitepaper from MimecastDownload now

WebKit, alongside its use in Safari, is also used in various iOS, macOS, watchOS and Apple TV apps and services. 

The latest version of Safari released in April brought with it a host of new WebKit features, APIs, performance improvements and better compatibility for web developers. For example, Safari 14.1 now supports a media encoder as well as date and time inputs on macOS. 

Support for the AudioWorklets technology, a web standard that optimises audio processing in the browser, however, brought with it a glaring security issue

Researchers with Theori reported that a bug in the implementation of this feature made it possible to use technology to get Safari and other WebKit-based browsers to run arbitrary code. Although the WebKit developers fixed the bug, Apple’s Safari developers didn’t bake this into the web browser on iOS or macOS. 

Featured Resources

Next-generation time series: Forecasting for the real world, not the ideal world

Solve time series problems with AI

Free download

The future of productivity

Driving your business forward with Microsoft Office 365

Free download

How to plan for endpoint security against ever-evolving cyber threats

Safeguard your devices, data, and reputation

Free download

A quantitative comparison of UPS monitoring and servicing approaches across edge environments

Effective UPS fleet management

Free download

Recommended

IT Pro News in Review: MacBook refresh, Facebook creating jobs and facial recognition in schools
Hardware

IT Pro News in Review: MacBook refresh, Facebook creating jobs and facial recognition in schools

22 Oct 2021
Apple unveils redesigned MacBook Pro with M1 Pro, M1 Max chips
Laptops

Apple unveils redesigned MacBook Pro with M1 Pro, M1 Max chips

18 Oct 2021
Kaspersky exposes MysterySnail zero-day exploit in Windows
zero-day exploit

Kaspersky exposes MysterySnail zero-day exploit in Windows

13 Oct 2021
Apple reportedly slashes iPhone 13 production due to chip crisis
components

Apple reportedly slashes iPhone 13 production due to chip crisis

13 Oct 2021

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans
Laptops

Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans

11 Oct 2021
Royal Mint to recover gold from smartphones and laptops in world first
Technology

Royal Mint to recover gold from smartphones and laptops in world first

21 Oct 2021