PT-2023-8420 · Apple · Applemobilefileintegrity+4

Patch1T · Published 2023-09-26 · Updated 2024-01-17 · CVE-2023-42872

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AppleMobileFileIntegrity versions prior to macOS Sonoma 14 Safari versions prior to iOS 17 Safari versions prior to iPadOS 17

Description The issue is related to errors in processing permissions in the AppleMobileFileIntegrity component of the Safari browser, as well as in the macOS, iOS, and iPadOS operating systems. Exploitation of the issue may allow an attacker to disclose protected information. An app may be able to access sensitive user data.

Recommendations For versions prior to macOS Sonoma 14, update to macOS Sonoma 14 to resolve the issue. For versions prior to iOS 17, update to iOS 17 to resolve the issue. For versions prior to iPadOS 17, update to iPadOS 17 to resolve the issue. As a temporary workaround, consider restricting access to sensitive user data until a patch is available.

Fix

Weakness Enumeration

CWE-275

Related Identifiers

BDU:2024-00693

CVE-2023-42872

Affected Products

Applemobilefileintegrity

Apple Macos

Safari

Ios

Ipados

References · 9

• https://support.apple.com/en-us/HT213938 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00693 · Security Note
• https://osv.dev/vulnerability/CVE-2023-42872 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42872 · Security Note
• https://support.apple.com/en-us/HT213940 · Vendor Advisory
• https://vuldb.com/?id.250412 · Note
• https://t.me/cvenotify/67645 · Telegram Post
• https://support.apple.com/kb/HT213938 · Note
• https://support.apple.com/kb/HT213940 · Note