In an effort to ensure the safety and security of its customers, Apple has taken the necessary steps to address a potentially dangerous vulnerability that has been marked as “Zero-Day” by releasing updates for older iPhone and iPad models.
The vulnerability, tracked as CVE-2022-42856, originates from a type confusion weakness within the Webkit web browser engine developed by Apple. In light of CVE-2022-42856, Apple has released iOS 12.5.7, which patches the vulnerability.
Exploitation
Google’s Threat Analysis Group (TAG) first observed the exploitation of this vulnerability, which enables specially crafted web content to execute arbitrary code.
Attackers can take advantage of this vulnerability by creating a website that is specifically designed to exploit the flaw.
They can then deceive their targets into visiting the malicious website controlled by them by sending them a link through mediums like email or social media, or by disguising the website as a legitimate one through phishing tactics.
The ability to execute arbitrary codes could enable the perpetrators to carry out the following illicit activities once they have achieved it:-
- The underlying operating system can be used to execute commands
- Deploy additional malware
- Deploy spyware payloads
- Initiate other malicious activities
When Apple released iOS 16.1.2 in December 2022, the first round of patches for CVE-2022-42856 was rolled out by Apple as part of this release.
Affected Devices and Fix
There were several devices that were affected by the zero-day bug, and the company implemented a solution to fix it. Here below we have mentioned the devices that were affected by this flaw:-
- iPhone 5s
- iPhone 6
- iPhone 6 Plus
- iPad Air
- iPad mini 2
- iPad mini 3
- iPod touch (6th generation)
Apart from this Apple released iOS 12.5.7 for the above-mentioned Apple devices to address this zero-day flaw.
It is expected that Apple’s intention is to ensure a large number of users have the opportunity to update their devices with a patch before any other attackers discover the zero-day vulnerability and exploit it by creating custom exploits.
Although it appears that this security vulnerability was mainly employed in targeted attacks, cybersecurity analysts have strongly urged users to immediately apply the latest security updates that are released recently to mitigate and stop future attacks.
Despite the fact that security updates for iOS 12 are becoming less common, however, Apple continues to ensure its users are safe from exploits by releasing patches when necessary.