CVE-2021-30860 in apple ipados
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Affected software: apple ipados, apple iphone os, apple mac os x, apple macos, apple watchos, xpdfreader xpdf, freedesktop poppler
Scores
- CVSS: 7.8 (high)
- EPSS: 75.99% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2021-11-03
- Published: 2021-08-24
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Update Apple devices to fix the CoreGraphics PDF integer overflow (FORCEDENTRY)
Patch or upgrade. Install Apple's September 2021 updates (iOS/iPadOS 14.8, macOS Big Sur 11.6, Security Update 2021-005 Catalina, watchOS 7.6.2) or later, which fix the CoreGraphics integer overflow exploited in the wild by the zero-click FORCEDENTRY iMessage chain. Updating removes the vulnerable code.
Applies to: iOS and iPadOS before 14.8, macOS Big Sur before 11.6, macOS Catalina without Security Update 2021-005, watchOS before 7.6.2.
- Inventory Apple devices in your MDM (Jamf, Intune, Kandji, Apple Business Manager) and list those on iOS/iPadOS below 14.8, macOS Big Sur below 11.6, macOS Catalina without Security Update 2021-005, and watchOS below 7.6.2.
- iPhone and iPad: push iOS/iPadOS 14.8 or later (preferably the latest supported release) via an MDM software update command, or have users go to Settings > General > Software Update.
- Mac on Big Sur: install macOS Big Sur 11.6 or later (System Preferences > Software Update, or an MDM scheduled OS update); upgrading to a current macOS release also fixes it.
- Mac on Catalina: install Security Update 2021-005 Catalina or later via Software Update.
- Apple Watch: update to watchOS 7.6.2 or later from the Watch app on the paired iPhone (General > Software Update).
- Devices that cannot reach these versions (older hardware) should be retired or kept off corporate data and messaging.
- For users at high risk of targeted spyware, additionally turn on Lockdown Mode (iOS 16 / macOS Ventura and later) to block complex iMessage attachments.
- Confirm in the MDM inventory that no device remains below the fixed versions.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.