Vulnerabilities > CVE-2019-6214 - Type Confusion vulnerability in Apple products

047910
CVSS 6.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
apple
CWE-843
nessus
exploit available

Summary

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2, watchOS 5.1.3. A malicious application may be able to break out of its sandbox.

Vulnerable Configurations

Part Description Count
OS
Apple
327

Exploit-Db

fileexploits/multiple/dos/46298.c
idEDB-ID:46298
last seen2019-01-31
modified2019-01-31
platformmultiple
port
published2019-01-31
reporterExploit-DB
sourcehttps://www.exploit-db.com/download/46298
titlemacOS < 10.14.3 / iOS < 12.1.3 - Sandbox Escapes due to Type Confusions and Memory Safety Issues in iohideventsystem
typedos

Nessus

  • NASL familyMacOS X Local Security Checks
    NASL idMACOS_10_14_3.NASL
    descriptionThe remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.3. It is, therefore, affected by multiple vulnerabilities related to the following components: - AppleKeyStore - Bluetooth - Core Media - CoreAnimation - FaceTime - IOKit - Kernel - libxpc - Natural Language Processing - QuartzCore - SQLite - WebRTC Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id121393
    published2019-01-25
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121393
    titlemacOS 10.14.x < 10.14.3 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(121393);
      script_version("1.5");
      script_cvs_date("Date: 2019/10/31 15:18:51");
    
      script_cve_id(
        "CVE-2018-20346",
        "CVE-2018-20505",
        "CVE-2018-20506",
        "CVE-2019-6200",
        "CVE-2019-6202",
        "CVE-2019-6205",
        "CVE-2019-6208",
        "CVE-2019-6209",
        "CVE-2019-6210",
        "CVE-2019-6211",
        "CVE-2019-6213",
        "CVE-2019-6214",
        "CVE-2019-6218",
        "CVE-2019-6219",
        "CVE-2019-6220",
        "CVE-2019-6221",
        "CVE-2019-6224",
        "CVE-2019-6225",
        "CVE-2019-6230",
        "CVE-2019-6231",
        "CVE-2019-6235"
      );
      script_bugtraq_id(106323, 106693, 106694);
      script_xref(name:"APPLE-SA", value:"APPLE-SA-2019-1-22-2");
    
      script_name(english:"macOS 10.14.x < 10.14.3 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of Mac OS X / macOS.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote host is missing a macOS update that fixes multiple security
    vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote host is running a version of macOS / Mac OS X that is
    10.14.x prior to 10.14.3. It is, therefore, affected by multiple
    vulnerabilities related to the following components:
    
      - AppleKeyStore
      - Bluetooth
      - Core Media
      - CoreAnimation
      - FaceTime
      - IOKit
      - Kernel
      - libxpc
      - Natural Language Processing
      - QuartzCore
      - SQLite
      - WebRTC
    
    Note that successful exploitation of the most serious issues can
    result in arbitrary code execution.");
      script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT209446");
      # https://lists.apple.com/archives/security-announce/2019/Jan/msg00001.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a77b9bea");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to macOS version 10.14.3 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6218");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/22");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/01/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/25");
    
      script_set_attribute(attribute:"plugin_type", value:"combined");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:macos");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl", "os_fingerprint.nasl");
      script_require_ports("Host/MacOSX/Version", "Host/OS");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    
    
    fix = "10.14.3";
    minver = "10.14";
    
    os = get_kb_item("Host/MacOSX/Version");
    if (!os)
    {
      os = get_kb_item_or_exit("Host/OS");
      if ("Mac OS X" >!< os) audit(AUDIT_OS_NOT, "macOS / Mac OS X");
    
      c = get_kb_item("Host/OS/Confidence");
      if (c <= 70) exit(1, "Can't determine the host's OS with sufficient confidence.");
    }
    if (!os) audit(AUDIT_OS_NOT, "macOS / Mac OS X");
    
    matches = pregmatch(pattern:"Mac OS X ([0-9]+(\.[0-9]+)+)", string:os);
    if (empty_or_null(matches)) exit(1, "Failed to parse the macOS / Mac OS X version ('" + os + "').");
    
    version = matches[1];
    
    if (ver_compare(ver:version, minver:minver, fix:fix, strict:FALSE) == -1)
    {
      security_report_v4(
        port:0,
        severity:SECURITY_HOLE,
        extra:
          '\n  Installed version : ' + version +
          '\n  Fixed version     : ' + fix +
          '\n'
      );
    }
    else audit(AUDIT_INST_VER_NOT_VULN, "macOS / Mac OS X", version);
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD_10_13_6_2019-001.NASL
    descriptionThe remote host is running macOS 10.13.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities in the following components: - Bluetooth - Core Media - CoreAnimation - FaceTime - Hypervisor - Intel Graphics Driver - IOKit - Kernel - libxpc - QuartzCore
    last seen2020-03-18
    modified2019-01-25
    plugin id121392
    published2019-01-25
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121392
    titlemacOS 10.13.6 Multiple Vulnerabilities (Security Update 2019-001)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(121392);
      script_version("1.6");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/13");
    
      script_cve_id(
        "CVE-2018-4452",
        "CVE-2018-4467",
        "CVE-2019-6200",
        "CVE-2019-6202",
        "CVE-2019-6205",
        "CVE-2019-6208",
        "CVE-2019-6209",
        "CVE-2019-6210",
        "CVE-2019-6213",
        "CVE-2019-6214",
        "CVE-2019-6218",
        "CVE-2019-6220",
        "CVE-2019-6221",
        "CVE-2019-6224",
        "CVE-2019-6225",
        "CVE-2019-6230",
        "CVE-2019-6231"
      );
      script_bugtraq_id(106693, 106694);
      script_xref(name:"APPLE-SA", value:"APPLE-SA-2019-1-22-2");
    
      script_name(english:"macOS 10.13.6 Multiple Vulnerabilities (Security Update 2019-001)");
      script_summary(english:"Checks for the presence of Security Update 2019-001");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote host is missing a macOS security update that fixes
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote host is running macOS 10.13.6 and is missing a security
    update. It is therefore, affected by multiple vulnerabilities in 
    the following components:
    
      - Bluetooth
      - Core Media
      - CoreAnimation
      - FaceTime
      - Hypervisor
      - Intel Graphics Driver
      - IOKit
      - Kernel
      - libxpc
      - QuartzCore");
      script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT209446");
      # https://lists.apple.com/archives/security-announce/2019/Jan/msg00001.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a77b9bea");
      script_set_attribute(attribute:"solution", value:
    "Install Security Update 2019-001 or later for 10.13.6.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6218");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/22");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/01/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/25");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:macos");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version", "Host/MacOSX/packages/boms");
    
      exit(0);
    }
    
    include('lists.inc');
    include('vcf.inc');
    include('vcf_extras_apple.inc');
    
    app_info = vcf::apple::macos::get_app_info();
    
    constraints = [
      { 'min_version' : '10.13', 'max_version' : '10.13.6', 'fixed_build': '17G5019', 'fixed_display' : '10.13.6 Security Update 2019-001' }
    ];
    vcf::apple::macos::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2019-001.NASL
    descriptionThe remote host is running Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities in the following components: - CoreAnimation - Hypervisor - Intel Graphics Driver - IOKit - Kernel - libxpc - QuartzCore
    last seen2020-06-01
    modified2020-06-02
    plugin id121391
    published2019-01-25
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121391
    titlemacOS and Mac OS X Multiple Vulnerabilities (Security Update 2019-001)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(121391);
      script_version("1.5");
      script_cvs_date("Date: 2019/10/31 15:18:51");
    
      script_cve_id(
        "CVE-2018-4452",
        "CVE-2018-4467",
        "CVE-2019-6205",
        "CVE-2019-6208",
        "CVE-2019-6209",
        "CVE-2019-6210",
        "CVE-2019-6213",
        "CVE-2019-6214",
        "CVE-2019-6218",
        "CVE-2019-6220",
        "CVE-2019-6224",
        "CVE-2019-6225",
        "CVE-2019-6230",
        "CVE-2019-6231"
      );
      script_bugtraq_id(106693);
      script_xref(name:"APPLE-SA", value:"APPLE-SA-2019-1-22-2");
    
      script_name(english:"macOS and Mac OS X Multiple Vulnerabilities (Security Update 2019-001)");
      script_summary(english:"Checks for the presence of Security Update 2019-001.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote host is missing a macOS or Mac OS X security update that
    fixes multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote host is running Mac OS X 10.12.6 and is missing a security
    update. It is therefore, affected by multiple vulnerabilities in the 
    following components:
    
      - CoreAnimation
      - Hypervisor
      - Intel Graphics Driver
      - IOKit
      - Kernel
      - libxpc
      - QuartzCore");
      script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT209446");
      # https://lists.apple.com/archives/security-announce/2019/Jan/msg00001.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a77b9bea");
      script_set_attribute(attribute:"solution", value:
    "Install Security Update 2019-001 or later for 10.12.x.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6218");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/22");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/01/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/25");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:macos");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version", "Host/MacOSX/packages/boms");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    
    # Compare 2 patch numbers to determine if patch requirements are satisfied.
    # Return true if this patch or a later patch is applied
    # Return false otherwise
    function check_patch(year, number)
    {
      local_var p_split = split(patch, sep:"-");
      local_var p_year  = int( p_split[0]);
      local_var p_num   = int( p_split[1]);
    
      if (year >  p_year) return TRUE;
      else if (year <  p_year) return FALSE;
      else if (number >=  p_num) return TRUE;
      else return FALSE;
    }
    
    get_kb_item_or_exit("Host/local_checks_enabled");
    os = get_kb_item_or_exit("Host/MacOSX/Version");
    
    if (!preg(pattern:"Mac OS X 10\.12\.6([^0-9]|$)", string:os))
      audit(AUDIT_OS_NOT, "Mac OS X 10.12.6");
    
    patch = "2019-001";
    
    packages = get_kb_item_or_exit("Host/MacOSX/packages/boms", exit_code:1);
    sec_boms_report = pgrep(
      pattern:"^com\.apple\.pkg\.update\.(security\.|os\.SecUpd).*bom$",
      string:packages
    );
    sec_boms = split(sec_boms_report, sep:'\n');
    
    foreach package (sec_boms)
    {
      # Grab patch year and number
      matches = pregmatch(pattern:"[^0-9](20[0-9][0-9])[-.]([0-9]{3})[^0-9]", string:package);
      if (empty_or_null(matches)) continue;
      if (empty_or_null(matches[1]) || empty_or_null(matches[2]))
        continue;
    
      patch_found = check_patch(year:int(matches[1]), number:int(matches[2]));
      if (patch_found) exit(0, "The host has Security Update " + patch + " or later installed and is therefore not affected.");
    }
    
    report =  '\n  Missing security update : ' + patch;
    report += '\n  Installed security BOMs : ';
    if (sec_boms_report) report += str_replace(find:'\n', replace:'\n                            ', string:sec_boms_report);
    else report += 'n/a';
    report += '\n';
    
    security_report_v4(port:0, severity:SECURITY_HOLE, extra:report);