Details of VAR-201904-1435

ID

VAR-201904-1435

CVE

CVE-2018-4380

TITLE

iOS Lock screen vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-014984

DESCRIPTION

A lock screen issue allowed access to photos and contacts on a locked device. This issue was addressed by restricting options offered on a locked device. This issue affected versions prior to iOS 12.0.1. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Service operation interruption (DoS) * Arbitrary code execution * Script execution * information leak * Access restriction avoidance. Apple iOS is prone to multiple local information-disclosure vulnerabilities. Attackers can exploit these issues to obtain sensitive information that may aid in launching further attacks. VoiceOver is one of the voice assistant components. CVE-2018-4380: videosdebarraquito Quick Look Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local attacker may be able to share items from the lock screen Description: A lock screen issue allowed access to the share function on a locked device. CVE-2018-4379: videosdebarraquito Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlu7i3gACgkQeC9tht7T K3H2lQ/+Kvfxyl73DfM5KcArmL8+hukFZBG5hM6w/N0Y+5GLME6FYCsk0BRXJ+tm FBTgLDnWzjOiPRAjns5qonHHaSRGJzBFwNt1O23qfRZKS3uVtsRCqFXfrL48irgH S4nw85vfcbpgsb7r7Lka5uw/yQ2XjDTlp3CFNYJEPT+YA7QmBpOwKu4OwwbNJIRo HtlzkdnFaSYTFMKaZgYE8ykUEUYBGW0MwXh8M+tT+gZKfCIc4fUDqjI2HZLANZ4x cM7vgn2+tnjnSOOm9C0/xnzh9nEGA+/JoF+pZW2HQpg7mH30ssMyaHUkCCriKRgw k7PArRTAWBmZknJrdbk21w8ohNbArF/0TmU+yehQ2NuoAVQEdPSaEIMVvwXoRSn5 x+phJ0mLdSXpwFhJLo6rbHGCcd8aY0qt+N//AL65kBDDDt81R8vf0DGo8asBAOX9 w/D2n2ymZF3OJ1jgxX5rYPRKtmuk0iJRskGPe5gbXunCbDW9y5FTpzk0k48pjmk4 ibxlXo0mEo/W+RPIDezoFXrbFSJrAlrZy42KC8kJ3Qd+hnhOWb3yNxAx/bHrkNQd xRyG7SVpd8S5BhPAAb5qcy56z96/EsXLbE5RF9HiWVm+WCJPoprW1W/eWzdhmsFJ pPr4OwkUQ26ua8jPC1zg8HIW0ohDsinnPphJiynez8c0EE4UyXw= =yoiM -----END PGP SIGNATURE-----

Trust: 2.79

sources: NVD: CVE-2018-4380 // JVNDB: JVNDB-2018-014984 // JVNDB: JVNDB-2018-008148 // BID: 105528 // VULHUB: VHN-134411 // PACKETSTORM: 149721

AFFECTED PRODUCTS

vendor:	apple	model:	iphone os	scope:	lt	version:	12.1	Trust: 1.0
vendor:	apple	model:	ios	scope:	lt	version:	12.0.1 (ipad air or later )	Trust: 0.8
vendor:	apple	model:	ios	scope:	lt	version:	12.0.1 (iphone 5s or later )	Trust: 0.8
vendor:	apple	model:	ios	scope:	lt	version:	12.0.1 (ipod touch first 6 generation )	Trust: 0.8
vendor:	apple	model:	icloud	scope:	lt	version:	7.7 earlier	Trust: 0.8
vendor:	apple	model:	ios	scope:	lt	version:	12.0.1 earlier	Trust: 0.8
vendor:	apple	model:	ipod touch	scope:	eq	version:	0	Trust: 0.3
vendor:	apple	model:	iphone	scope:	eq	version:	0	Trust: 0.3
vendor:	apple	model:	ipad air	scope:	eq	version:	0	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	50	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	40	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	30	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.4.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.2.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.0.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.3.4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.3.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.3.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.3.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.2.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.0.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.0.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.4.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.0.6	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.0.5	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.0.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.0.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.0.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.3.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.1.6	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.1.4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.1.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.0.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.0.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	3.2.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	3.2.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.3.5	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.1.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.1.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.1.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.1.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.1.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.0.4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.0.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.0.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	5.1.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	5.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	5.0.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	5	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.3.5	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.3.4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.3.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.3.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.3.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.9	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.8	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.7	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.6	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.5	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.10	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	3.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	3.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	3.0	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	2.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	2.0	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	12	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.3.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.2.6	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.2.5	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.2.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.2.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	11	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.3.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.3.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.3.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	0	Trust: 0.3
vendor:	apple	model:	ios	scope:	ne	version:	12.0.1	Trust: 0.3

sources: BID: 105528 // JVNDB: JVNDB-2018-014984 // JVNDB: JVNDB-2018-008148 // NVD: CVE-2018-4380

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-4380
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2018-4380
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201810-352
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-134411
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2018-4380
severity:	LOW
baseScore:	2.1
vectorString:	AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-134411
severity:	LOW
baseScore:	2.1
vectorString:	AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-4380
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	1.8
impactScore:	3.6
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-134411 // JVNDB: JVNDB-2018-014984 // CNNVD: CNNVD-201810-352 // NVD: CVE-2018-4380

PROBLEMTYPE DATA

problemtype:

CWE-200

Trust: 1.9

sources: VULHUB: VHN-134411 // JVNDB: JVNDB-2018-014984 // NVD: CVE-2018-4380

THREAT TYPE

local

Trust: 0.9

sources: BID: 105528 // CNNVD: CNNVD-201810-352

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201810-352

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-014984

PATCH

title:	HT209162	url:	https://support.apple.com/en-us/HT209162	Trust: 1.6
title:	HT209162	url:	https://support.apple.com/ja-jp/HT209162	Trust: 0.8
title:	About the security content of iCloud for Windows 7.7	url:	https://support.apple.com/en-us/HT209141	Trust: 0.8
title:	Apple iOS VoiceOver Repair measures for information disclosure vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=85545	Trust: 0.6

sources: JVNDB: JVNDB-2018-014984 // JVNDB: JVNDB-2018-008148 // CNNVD: CNNVD-201810-352

EXTERNAL IDS

db:	NVD	id:	CVE-2018-4380	Trust: 2.9
db:	JVN	id:	JVNVU92800088	Trust: 1.6
db:	JVNDB	id:	JVNDB-2018-014984	Trust: 0.8
db:	JVNDB	id:	JVNDB-2018-008148	Trust: 0.8
db:	CNNVD	id:	CNNVD-201810-352	Trust: 0.7
db:	BID	id:	105528	Trust: 0.3
db:	VULHUB	id:	VHN-134411	Trust: 0.1
db:	PACKETSTORM	id:	149721	Trust: 0.1

sources: VULHUB: VHN-134411 // BID: 105528 // JVNDB: JVNDB-2018-014984 // JVNDB: JVNDB-2018-008148 // PACKETSTORM: 149721 // CNNVD: CNNVD-201810-352 // NVD: CVE-2018-4380

REFERENCES

url:	https://support.apple.com/ht209162	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2018-4380	Trust: 1.5
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-4380	Trust: 0.8
url:	https://jvn.jp/vu/jvnvu92800088/index.html	Trust: 0.8
url:	http://jvn.jp/cert/jvnvu92800088	Trust: 0.8
url:	https://support.apple.com/en-us/ht209162	Trust: 0.3
url:	https://www.apple.com/	Trust: 0.3
url:	https://www.apple.com/itunes/	Trust: 0.1
url:	https://support.apple.com/kb/ht201222	Trust: 0.1
url:	https://www.apple.com/support/security/pgp/	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2018-4379	Trust: 0.1

sources: VULHUB: VHN-134411 // BID: 105528 // JVNDB: JVNDB-2018-014984 // JVNDB: JVNDB-2018-008148 // PACKETSTORM: 149721 // CNNVD: CNNVD-201810-352 // NVD: CVE-2018-4380

CREDITS

videosdebarraquito

Trust: 0.9

sources: BID: 105528 // CNNVD: CNNVD-201810-352

SOURCES

db:	VULHUB	id:	VHN-134411
db:	BID	id:	105528
db:	JVNDB	id:	JVNDB-2018-014984
db:	JVNDB	id:	JVNDB-2018-008148
db:	PACKETSTORM	id:	149721
db:	CNNVD	id:	CNNVD-201810-352
db:	NVD	id:	CVE-2018-4380

LAST UPDATE DATE

2024-11-23T19:52:09.806000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-134411	date:	2019-04-08T00:00:00
db:	BID	id:	105528	date:	2018-10-08T00:00:00
db:	JVNDB	id:	JVNDB-2018-014984	date:	2019-04-18T00:00:00
db:	JVNDB	id:	JVNDB-2018-008148	date:	2018-10-10T00:00:00
db:	CNNVD	id:	CNNVD-201810-352	date:	2019-04-09T00:00:00
db:	NVD	id:	CVE-2018-4380	date:	2024-11-21T04:07:17.980

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-134411	date:	2019-04-03T00:00:00
db:	BID	id:	105528	date:	2018-10-08T00:00:00
db:	JVNDB	id:	JVNDB-2018-014984	date:	2019-04-18T00:00:00
db:	JVNDB	id:	JVNDB-2018-008148	date:	2018-10-10T00:00:00
db:	PACKETSTORM	id:	149721	date:	2018-10-09T16:57:43
db:	CNNVD	id:	CNNVD-201810-352	date:	2018-10-10T00:00:00
db:	NVD	id:	CVE-2018-4380	date:	2019-04-03T18:29:11.957