Connect with us

Hi, what are you looking for?


CISA orders federal agencies to update iPhones, Macs until Feb 25th

1642886655 CISA

CISA orders federal agencies to update iPhones until Feb 25th

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a new flaw to its catalog of vulnerabilities exploited in the wild, an Apple WebKit remote code execution bug used to target iPhones, iPads, and Macs.

According to the binding operational directive (BOD 22-01) issued by CISA in November, federal agencies are now required to patch their systems against this actively exploited vulnerability impacting iOS, iPadOS, and macOS devices.

CISA said that all Federal Civilian Executive Branch Agencies (FCEB) agencies have to patch the vulnerability tracked as CVE-2022-22620 [1, 2] until February 25th, 2022.

“These types of vulnerabilities are a frequent attack vector for malicious cyber actors of all types and pose significant risk to the federal enterprise,” the cybersecurity agency said.

“Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice.”

Yesterday, CISA also asked FCEB agencies to patch 15 other vulnerabilities tagged as being under active exploitation, with CVE-2021-36934 — a Microsoft Windows SAM (Security Accounts Manager) bug allowing privilege escalation and credential theft — having a February 24th patch deadline.

Third zero-day patched by Apple this year

The CVE-2022-22620 is the third zero-day Apple has patched since the start of 2022 and is a WebKit Use After Free issue exploitable for OS crashes and code execution on vulnerable devices.

Advertisement. Scroll to continue reading.

Successful exploitation enables attackers to execute arbitrary code on iPhones, iPads, and Macs after opening maliciously crafted web pages using Safari.

“In particular, all browsers for iOS and iPadOS are based on this open source engine — that is, not only iPhone’s default Safari, but also Google Chrome, Mozilla Firefox and any others,” Kaspersky said today. “So even if you do not use Safari, this vulnerability still affects you directly.”

“Apple is aware of a report that this issue may have been actively exploited,” the company added when describing the zero-day.

Apple has addressed the vulnerability with improved memory management in iOS 15.3.1, iPadOS 15.3.1, and macOS Monterey 12.2.1.

The complete list of impacted devices is quite extensive, and it includes iPhone 6s and later, multiple iPad models, and Macs running macOS Monterey.

Even though this flaw was likely only used in a small number of targeted attacks, it’s still highly recommended to install the updates as soon as possible to block potential attack attempts, just as CISA urged earlier today.

In January, Apple also patched two other actively exploited zero-days that can let attackers track browsing activity and users’ identities in real-time (CVE-2022-22594) and gain arbitrary code execution with kernel privileges (CVE-2022-22587).

Source link

Advertisement. Scroll to continue reading.
Click to comment

Leave a Reply


Online Business Success

Stefan Leipold CEO of STARK & and getty As we all know, one thing is 100% certain: The way we work will...

Loan And Finance

Saban Music Group says it has “fortified” the executive team of its recently launched Saban Music Latin division by hiring Liz Leyva as Vice...


What just happened? It’s been almost seven years since a class-action lawsuit was launched against Facebook in Illinois that alleged the company violated citizens’...

Loan And Finance

Getting paid to write may sound easy, but the reality is a little more complicated. Freelance writing can be hard to break into, and...

Loan And Finance

Amongst the multitude of tempting reasons for Sony Music to acquire AWAL last year (*cough* instant market share *cough*) was the ex-Kobat platform’s uncommon...

Online Business Success

A general view of electricity pylons in Mumbai, India, October 13, 2021. — Reuters NEW DELHI: India is facing its worst power crisis in...


You May Also Like


Introductions get a lot of attention. I’ve explored the topic of how to write them even though as a reader, I always skip them....

SEO Guide

There are all kinds of pictures of the world on the internet, but to find one of these specific pictures that you want to...

Online Business Success

The internet is now our nervous system. We are constantly streaming and buying and watching and liking, our brains locked into the global information...

Online Business Success

You can think of link building in many ways. I like to call it tedious, painful, and a test of patience. It’s also necessary...