Passcode bypass in Apple iOS

Published: 2018-10-09

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2018-4380 CVE-2018-4379
CWE-ID	CWE-264
Exploitation vector	Local
Public exploit	N/A
Vulnerable software Subscribe	Apple iOS Operating systems & Components / Operating system
Vendor	Apple Inc.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Passcode bypass

EUVDB-ID: #VU15191

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-4380

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to view photos and contacts from the lock screen.

The weakness exists in QuickLook due to improper restriction of options offered on a locked device. A local attacker can bypass the iOS lock screen and see contacts, photos, emails, and telephone numbers.

Mitigation

Update to version 12.0.1.

Vulnerable software versions

Apple iOS: 12.0 16A366

External links

http://support.apple.com/en-ie/HT209162

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Passcode bypass

EUVDB-ID: #VU15192