All your Apple devices need to be patched ASAP – here’s why - ZDNET
Apple has released 12 software updates to address security vulnerabilities affecting iPhones, iPads, Macs, Apple Watches, and Vision Pro devices.
On Tuesday, Apple released security patches for iOS, iPadOS, MacOS, WatchOS, and VisionOS, addressing wireless security flaws in Bluetooth pairing, AirPlay, and Messages. These vulnerabilities could allow attackers to establish Bluetooth connections without user interaction, bypass AirPlay connection limits, and join iMessage group chats to read messages.
Apple's security notes reveal that approximately half of these flaws were discovered internally by Apple's security team, while the remaining issues were reported by external researchers. The company has emphasized the importance of applying these updates across all affected devices.
iMessage vulnerabilities
One critical fix addresses an authorization issue in Messages that prevented attackers from remotely joining iMessage group chats without permission. "An authorization issue was addressed with improved validation," Apple stated in their security notes.
an authorization issue was addressed with improved validation
Another issue allowed newly added group members to access messages sent before they joined the conversation. Apple has removed the problematic code to prevent this unauthorized access.
Bluetooth and AirPlay flaws
A widespread Bluetooth vulnerability could enable malicious actors to establish connections to devices without user interaction. While Apple didn't specify the exact nature of this flaw, it appears related to Bluetooth Low Energy Re-Pairing vulnerabilities discovered earlier this year by French researchers.
The fix for this issue involves "improved checks" during the pairing process, likely strengthening verification steps. Similarly, an AirPlay vulnerability allowed attackers to bypass rate limits on pairing code attempts through brute-force methods.
This issue affects devices when pairing with AirPlay receivers like Apple TV or AirPlay-enabled TVs. Apple addressed it with "improved state management" to prevent unauthorized access through repeated PIN attempts.
Related
