Sign-up

ID

VAR-201804-1153


CVE

CVE-2018-4151


TITLE

Apple iOS and macOS of iCloud Drive Component vulnerable to arbitrary code execution in privileged context

Trust: 0.8

sources: JVNDB: JVNDB-2018-003715

DESCRIPTION

An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. The issue involves the "iCloud Drive" component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app. Apple iOS and macOS are prone to multiple security vulnerabilities. An attacker can exploit these issues to perform unauthorized actions, and gain elevated privileges. Failed exploit attempts will likely cause a denial-of-service condition. in the United States. Apple iOS is an operating system developed for mobile devices; macOS High Sierra is a dedicated operating system developed for Mac computers

Trust: 1.98

sources: NVD: CVE-2018-4151 // JVNDB: JVNDB-2018-003715 // BID: 103581 // VULHUB: VHN-134182

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:eqversion:10.11.6

Trust: 1.4

vendor:applemodel:mac os xscope:eqversion:10.12.6

Trust: 1.4

vendor:applemodel:mac os xscope:ltversion:10.13.4

Trust: 1.0

vendor:applemodel:iphone osscope:ltversion:11.3

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.13.3

Trust: 0.8

vendor:applemodel:iosscope:ltversion:11.3 (ipad air or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:11.3 (iphone 5s or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:11.3 (ipod touch first 6 generation )

Trust: 0.8

vendor:applemodel:mac os xscope:eqversion:10.13.0

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.12.2

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.12.3

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.12.1

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.12.0

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.11.5

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.12.5

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.12.4

Trust: 0.6

vendor:applemodel:macosscope:eqversion:10.13.3

Trust: 0.3

vendor:applemodel:macosscope:eqversion:10.12.6

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:0

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:0

Trust: 0.3

vendor:applemodel:ipadscope:eqversion:0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:50

Trust: 0.3

vendor:applemodel:iosscope:eqversion:40

Trust: 0.3

vendor:applemodel:iosscope:eqversion:30

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.4.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.9

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.10

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11.2.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11.2.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11.2.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10

Trust: 0.3

vendor:applemodel:macosscope:neversion:10.13.4

Trust: 0.3

vendor:applemodel:iosscope:neversion:11.3

Trust: 0.3

sources: BID: 103581 // JVNDB: JVNDB-2018-003715 // CNNVD: CNNVD-201804-158 // NVD: CVE-2018-4151

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-4151
value: HIGH

Trust: 1.0

NVD: CVE-2018-4151
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201804-158
value: HIGH

Trust: 0.6

VULHUB: VHN-134182
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-4151
severity: HIGH
baseScore: 7.6
vectorString: AV:N/AC:H/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 4.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-134182
severity: HIGH
baseScore: 7.6
vectorString: AV:N/AC:H/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 4.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-4151
baseSeverity: HIGH
baseScore: 7.0
vectorString: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.0
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-134182 // JVNDB: JVNDB-2018-003715 // CNNVD: CNNVD-201804-158 // NVD: CVE-2018-4151

PROBLEMTYPE DATA

problemtype:CWE-362

Trust: 1.9

problemtype:CWE-264

Trust: 0.9

sources: VULHUB: VHN-134182 // JVNDB: JVNDB-2018-003715 // NVD: CVE-2018-4151

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201804-158

TYPE

competition condition problem

Trust: 0.6

sources: CNNVD: CNNVD-201804-158

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-003715

PATCH
title:HT208692url:https://support.apple.com/en-us/HT208692
Trust: 0.8
title:HT208693url:https://support.apple.com/en-us/HT208693
Trust: 0.8
title:HT208692url:https://support.apple.com/ja-jp/HT208692
Trust: 0.8
title:HT208693url:https://support.apple.com/ja-jp/HT208693
Trust: 0.8
title:Apple iOS  and macOS High Sierra iCloud Drive Repair measures for competitive conditionsurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=83010
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2018-003715 // 
            
            
            
            CNNVD: CNNVD-201804-158

EXTERNAL IDS
db:NVDid:CVE-2018-4151
Trust: 2.8
db:BIDid:103581
Trust: 2.0
db:SECTRACKid:1040604
Trust: 1.7
db:SECTRACKid:1040608
Trust: 1.7
db:JVNid:JVNVU92378299
Trust: 0.8
db:JVNDBid:JVNDB-2018-003715
Trust: 0.8
db:CNNVDid:CNNVD-201804-158
Trust: 0.7
db:VULHUBid:VHN-134182
Trust: 0.1
sources:
            
            
            VULHUB: VHN-134182 // 
            
            
            
            BID: 103581 // 
            
            
            
            JVNDB: JVNDB-2018-003715 // 
            
            
            
            CNNVD: CNNVD-201804-158 // 
            
            
            
            NVD: CVE-2018-4151

REFERENCES
url:http://www.securityfocus.com/bid/103581
Trust: 1.7
url:https://support.apple.com/ht208692
Trust: 1.7
url:https://support.apple.com/ht208693
Trust: 1.7
url:http://www.securitytracker.com/id/1040604
Trust: 1.7
url:http://www.securitytracker.com/id/1040608
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-4151
Trust: 0.8
url:http://jvn.jp/vu/jvnvu92378299/index.html
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-4151
Trust: 0.8
url:https://www.apple.com/
Trust: 0.3
url:http://www.apple.com/ios/
Trust: 0.3
url:https://support.apple.com/en-ie/ht208693
Trust: 0.3
url:https://support.apple.com/en-ie/ht208692
Trust: 0.3
sources:
            
            
            VULHUB: VHN-134182 // 
            
            
            
            BID: 103581 // 
            
            
            
            JVNDB: JVNDB-2018-003715 // 
            
            
            
            CNNVD: CNNVD-201804-158 // 
            
            
            
            NVD: CVE-2018-4151

CREDITS
Andreas Hegenberg of folivora.AI GmbH, Samuel Gro? (@5aelo), and an anonymous researcher.
Trust: 0.3
sources:
            
            
            BID: 103581

SOURCES
db:VULHUBid:VHN-134182
db:BIDid:103581
db:JVNDBid:JVNDB-2018-003715
db:CNNVDid:CNNVD-201804-158
db:NVDid:CVE-2018-4151

LAST UPDATE DATE
2024-11-23T19:35:41.025000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-134182date:2019-10-03T00:00:00
db:BIDid:103581date:2018-03-29T00:00:00
db:JVNDBid:JVNDB-2018-003715date:2018-06-01T00:00:00
db:CNNVDid:CNNVD-201804-158date:2019-10-23T00:00:00
db:NVDid:CVE-2018-4151date:2024-11-21T04:06:51.870

SOURCES RELEASE DATE
db:VULHUBid:VHN-134182date:2018-04-03T00:00:00
db:BIDid:103581date:2018-03-29T00:00:00
db:JVNDBid:JVNDB-2018-003715date:2018-06-01T00:00:00
db:CNNVDid:CNNVD-201804-158date:2018-04-03T00:00:00
db:NVDid:CVE-2018-4151date:2018-04-03T06:29:06.920