fkie_cve-2019-25071
Vulnerability from fkie_nvd
Published
2022-06-25 06:15
Modified
2024-11-21 04:39
Severity ?
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
A vulnerability was found in Apple iPhone up to 12.4.1. It has been declared as critical. Affected by this vulnerability is Siri. Playing an audio or video file might be able to initiate Siri on the same device which makes it possible to execute commands remotely. Exploit details have been disclosed to the public. The existence and implications of this vulnerability are doubted by Apple even though multiple public videos demonstrating the attack exist. Upgrading to version 13.0 migt be able to address this issue. It is recommended to upgrade affected devices. NOTE: Apple claims, that after examining the report they do not see any actual security implications.
References
product-security@apple.comhttps://vuldb.com/?id.143125
product-security@apple.comhttps://www.scip.ch/en/?labs.20191010
product-security@apple.comhttps://youtu.be/AeuGjMbAirU
af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?id.143125
af854a3a-2127-422b-91ae-364da2661108https://www.scip.ch/en/?labs.20191010
af854a3a-2127-422b-91ae-364da2661108https://youtu.be/AeuGjMbAirU
Impacted products
Vendor Product Version
apple iphone_os *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "03E861BE-9AB7-45CE-8977-BA832ACB6F30",
              "versionEndExcluding": "13.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in Apple iPhone up to 12.4.1. It has been declared as critical. Affected by this vulnerability is Siri. Playing an audio or video file might be able to initiate Siri on the same device which makes it possible to execute commands remotely. Exploit details have been disclosed to the public. The existence and implications of this vulnerability are doubted by Apple even though multiple public videos demonstrating the attack exist. Upgrading to version 13.0 migt be able to address this issue. It is recommended to upgrade affected devices. NOTE: Apple claims, that after examining the report they do not see any actual security implications."
    },
    {
      "lang": "es",
      "value": "Se ha encontrado una vulnerabilidad en el iPhone de Apple hasta la versi\u00f3n 12.4.1. Ha sido declarada como cr\u00edtica. Esta vulnerabilidad afecta a Siri. La reproducci\u00f3n de un archivo de audio o v\u00eddeo podr\u00eda iniciar Siri en el mismo dispositivo, lo que permite ejecutar comandos de forma remota. Los detalles del exploit han sido revelados al p\u00fablico. Apple duda de la existencia e implicaciones de esta vulnerabilidad, aunque existen m\u00faltiples v\u00eddeos p\u00fablicos que demuestran el ataque. La actualizaci\u00f3n a la versi\u00f3n 13.0 podr\u00eda solucionar este problema. Se recomienda actualizar los dispositivos afectados. NOTA: Apple afirma que, tras examinar el informe, no ve ninguna implicaci\u00f3n real para la seguridad"
    }
  ],
  "id": "CVE-2019-25071",
  "lastModified": "2024-11-21T04:39:53.167",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4,
        "source": "product-security@apple.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-06-25T06:15:07.150",
  "references": [
    {
      "source": "product-security@apple.com",
      "url": "https://vuldb.com/?id.143125"
    },
    {
      "source": "product-security@apple.com",
      "url": "https://www.scip.ch/en/?labs.20191010"
    },
    {
      "source": "product-security@apple.com",
      "url": "https://youtu.be/AeuGjMbAirU"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://vuldb.com/?id.143125"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.scip.ch/en/?labs.20191010"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://youtu.be/AeuGjMbAirU"
    }
  ],
  "sourceIdentifier": "product-security@apple.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ],
      "source": "product-security@apple.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.