Details of VAR-201904-1434

ID

VAR-201904-1434

CVE

CVE-2018-4379

TITLE

iOS Lock screen vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-014983

DESCRIPTION

A lock screen issue allowed access to the share function on a locked device. This issue was addressed by restricting options offered on a locked device. This issue affected versions prior to iOS 12.0.1. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Service operation interruption (DoS) * Arbitrary code execution * Script execution * information leak * Access restriction avoidance. Apple iOS is prone to multiple local information-disclosure vulnerabilities. Attackers can exploit these issues to obtain sensitive information that may aid in launching further attacks. Quick Look is one of the components used to view common resource files. An information disclosure vulnerability exists in the Quick Look component of Apple iOS prior to 12.0.1. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2018-10-08-1 iOS 12.0.1 iOS 12.0.1 is now available and addresses the following: VoiceOver Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local attacker may be able to view photos and contacts from the lock screen Description: A lock screen issue allowed access to photos and contacts on a locked device. CVE-2018-4379: videosdebarraquito Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlu7i3gACgkQeC9tht7T K3H2lQ/+Kvfxyl73DfM5KcArmL8+hukFZBG5hM6w/N0Y+5GLME6FYCsk0BRXJ+tm FBTgLDnWzjOiPRAjns5qonHHaSRGJzBFwNt1O23qfRZKS3uVtsRCqFXfrL48irgH S4nw85vfcbpgsb7r7Lka5uw/yQ2XjDTlp3CFNYJEPT+YA7QmBpOwKu4OwwbNJIRo HtlzkdnFaSYTFMKaZgYE8ykUEUYBGW0MwXh8M+tT+gZKfCIc4fUDqjI2HZLANZ4x cM7vgn2+tnjnSOOm9C0/xnzh9nEGA+/JoF+pZW2HQpg7mH30ssMyaHUkCCriKRgw k7PArRTAWBmZknJrdbk21w8ohNbArF/0TmU+yehQ2NuoAVQEdPSaEIMVvwXoRSn5 x+phJ0mLdSXpwFhJLo6rbHGCcd8aY0qt+N//AL65kBDDDt81R8vf0DGo8asBAOX9 w/D2n2ymZF3OJ1jgxX5rYPRKtmuk0iJRskGPe5gbXunCbDW9y5FTpzk0k48pjmk4 ibxlXo0mEo/W+RPIDezoFXrbFSJrAlrZy42KC8kJ3Qd+hnhOWb3yNxAx/bHrkNQd xRyG7SVpd8S5BhPAAb5qcy56z96/EsXLbE5RF9HiWVm+WCJPoprW1W/eWzdhmsFJ pPr4OwkUQ26ua8jPC1zg8HIW0ohDsinnPphJiynez8c0EE4UyXw= =yoiM -----END PGP SIGNATURE-----

Trust: 2.79

sources: NVD: CVE-2018-4379 // JVNDB: JVNDB-2018-014983 // JVNDB: JVNDB-2018-008148 // BID: 105528 // VULHUB: VHN-134410 // PACKETSTORM: 149721

AFFECTED PRODUCTS

vendor:	apple	model:	iphone os	scope:	lt	version:	12.0.1	Trust: 1.0
vendor:	apple	model:	ios	scope:	lt	version:	12.0.1 (ipad air or later )	Trust: 0.8
vendor:	apple	model:	ios	scope:	lt	version:	12.0.1 (iphone 5s or later )	Trust: 0.8
vendor:	apple	model:	ios	scope:	lt	version:	12.0.1 (ipod touch first 6 generation )	Trust: 0.8
vendor:	apple	model:	icloud	scope:	lt	version:	7.7 earlier	Trust: 0.8
vendor:	apple	model:	ios	scope:	lt	version:	12.0.1 earlier	Trust: 0.8
vendor:	apple	model:	ipod touch	scope:	eq	version:	0	Trust: 0.3
vendor:	apple	model:	iphone	scope:	eq	version:	0	Trust: 0.3
vendor:	apple	model:	ipad air	scope:	eq	version:	0	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	50	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	40	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	30	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.4.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.2.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.0.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.3.4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.3.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.3.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.3.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.2.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.0.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.0.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.4.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.0.6	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.0.5	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.0.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.0.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.0.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.3.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.1.6	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.1.4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.1.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.0.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.0.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	3.2.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	3.2.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.3.5	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.1.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.1.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.1.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.1.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.1.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.0.4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.0.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.0.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	5.1.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	5.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	5.0.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	5	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.3.5	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.3.4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.3.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.3.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.3.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.9	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.8	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.7	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.6	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.5	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.10	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	3.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	3.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	3.0	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	2.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	2.0	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	12	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.3.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.2.6	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.2.5	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.2.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.2.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.3.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.3.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.3.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	0	Trust: 0.3
vendor:	apple	model:	ios	scope:	ne	version:	12.0.1	Trust: 0.3

sources: BID: 105528 // JVNDB: JVNDB-2018-014983 // JVNDB: JVNDB-2018-008148 // NVD: CVE-2018-4379

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-4379
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2018-4379
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201810-353
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-134410
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2018-4379
severity:	LOW
baseScore:	2.1
vectorString:	AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-134410
severity:	LOW
baseScore:	2.1
vectorString:	AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-4379
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	1.8
impactScore:	3.6
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-134410 // JVNDB: JVNDB-2018-014983 // CNNVD: CNNVD-201810-353 // NVD: CVE-2018-4379

PROBLEMTYPE DATA

problemtype:

CWE-200

Trust: 1.9

sources: VULHUB: VHN-134410 // JVNDB: JVNDB-2018-014983 // NVD: CVE-2018-4379

THREAT TYPE

local

Trust: 0.9

sources: BID: 105528 // CNNVD: CNNVD-201810-353

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201810-353

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-014983

PATCH

title:	HT209162	url:	https://support.apple.com/en-us/HT209162	Trust: 1.6
title:	HT209162	url:	https://support.apple.com/ja-jp/HT209162	Trust: 0.8
title:	About the security content of iCloud for Windows 7.7	url:	https://support.apple.com/en-us/HT209141	Trust: 0.8
title:	Apple iOS Quick Look Repair measures for information disclosure vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=85546	Trust: 0.6

sources: JVNDB: JVNDB-2018-014983 // JVNDB: JVNDB-2018-008148 // CNNVD: CNNVD-201810-353

EXTERNAL IDS

db:	NVD	id:	CVE-2018-4379	Trust: 2.9
db:	JVN	id:	JVNVU92800088	Trust: 1.6
db:	JVNDB	id:	JVNDB-2018-014983	Trust: 0.8
db:	JVNDB	id:	JVNDB-2018-008148	Trust: 0.8
db:	CNNVD	id:	CNNVD-201810-353	Trust: 0.7
db:	BID	id:	105528	Trust: 0.3
db:	PACKETSTORM	id:	149721	Trust: 0.2
db:	VULHUB	id:	VHN-134410	Trust: 0.1

sources: VULHUB: VHN-134410 // BID: 105528 // JVNDB: JVNDB-2018-014983 // JVNDB: JVNDB-2018-008148 // PACKETSTORM: 149721 // CNNVD: CNNVD-201810-353 // NVD: CVE-2018-4379

REFERENCES

url:	https://support.apple.com/kb/ht209162	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2018-4379	Trust: 1.5
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-4379	Trust: 0.8
url:	https://jvn.jp/vu/jvnvu92800088/index.html	Trust: 0.8
url:	http://jvn.jp/cert/jvnvu92800088	Trust: 0.8
url:	https://support.apple.com/en-us/ht209162	Trust: 0.3
url:	https://www.apple.com/	Trust: 0.3
url:	https://www.apple.com/itunes/	Trust: 0.1
url:	https://support.apple.com/kb/ht201222	Trust: 0.1
url:	https://www.apple.com/support/security/pgp/	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2018-4380	Trust: 0.1

sources: VULHUB: VHN-134410 // BID: 105528 // JVNDB: JVNDB-2018-014983 // JVNDB: JVNDB-2018-008148 // PACKETSTORM: 149721 // CNNVD: CNNVD-201810-353 // NVD: CVE-2018-4379

CREDITS

videosdebarraquito

Trust: 0.9

sources: BID: 105528 // CNNVD: CNNVD-201810-353

SOURCES

db:	VULHUB	id:	VHN-134410
db:	BID	id:	105528
db:	JVNDB	id:	JVNDB-2018-014983
db:	JVNDB	id:	JVNDB-2018-008148
db:	PACKETSTORM	id:	149721
db:	CNNVD	id:	CNNVD-201810-353
db:	NVD	id:	CVE-2018-4379

LAST UPDATE DATE

2024-11-23T21:07:53.753000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-134410	date:	2019-04-05T00:00:00
db:	BID	id:	105528	date:	2018-10-08T00:00:00
db:	JVNDB	id:	JVNDB-2018-014983	date:	2019-04-18T00:00:00
db:	JVNDB	id:	JVNDB-2018-008148	date:	2018-10-10T00:00:00
db:	CNNVD	id:	CNNVD-201810-353	date:	2019-04-09T00:00:00
db:	NVD	id:	CVE-2018-4379	date:	2024-11-21T04:07:17.867

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-134410	date:	2019-04-03T00:00:00
db:	BID	id:	105528	date:	2018-10-08T00:00:00
db:	JVNDB	id:	JVNDB-2018-014983	date:	2019-04-18T00:00:00
db:	JVNDB	id:	JVNDB-2018-008148	date:	2018-10-10T00:00:00
db:	PACKETSTORM	id:	149721	date:	2018-10-09T16:57:43
db:	CNNVD	id:	CNNVD-201810-353	date:	2018-10-10T00:00:00
db:	NVD	id:	CVE-2018-4379	date:	2019-04-03T18:29:11.907