Prioritize Patching Apple OSes; Open Source Components Often Behind on Patched Versions; Restart Chrome Browsers to Fix Another Critical Vulnerability

Apple patched these flaws with its January updates, but did not disclose these flaws until last week. Last week, Apple updated the related advisories declaring that they patched these vulnerabilities.

Johannes Ullrich

The more time (i.e. decades) you spend in the industry watching things like this the more you are not shocked when mitigations are broken. Pointer Authentication was very much a game changer in exploit mitigation on this platform. Side stepping it to introduce a new class of bugs is fascinating and not surprising. Maybe what is surprising is that the technique was circling around for 4 years before this type of article came out. It is a patched set of bugs and you should keep your phones updated.

Moses Frost

These exploits are mitigated in iOS/iPadOS 16.3 and macOS 13.2. If you are still allowing devices to stay on iOS 15 or earlier it’s time to update. Note that updates to these new OS versions may require hardware replacements, so check your compatibility, keeping in mind getting new x86 Apple desktops is problematic.

Lee Neely

In the ancient days [1990s and earlier] you could look at the number of hours spent finding the next bug in a piece of software over time and see a knee in the curve – the point where it could be considered stable/secure enough to release. Of course, that was when new versions of software came out yearly or less, and complexity of code was much lower overall. There really are no more knees in the software risk curve – using software means and will always mean continual patching to reduce risk. That’s why browsers and cloud services update themselves so frequently.

John Pescatore

An example of security researchers properly disclosing a class of vulnerabilities to the software vendor. The result: affected software reviewed, software changes made, patch released, and researchers given appropriate credit for finding the class of vulnerabilities. Kudos to Trellix security researchers.

Curtis Dukes

As I understand it, this class of vulnerability can be exploited only by rogue applications, not from the user or network interfaces. Do I have that right?

William Hugh Murray

This advisory is probably one of the more concerning ones. With so many Exchange issues it would make sense to focus on AV, but how many admins are willing to claw back exclusions? A tool would be helpful from the AV vendors if it were possible.

Moses Frost

This is a step in the right direction for those of us hanging onto local Exchange deployments. Go through the update from Microsoft (link below) and make sure you have the minimum number of areas excluded from scans. Also verify you need to continue local instances of Exchange, and the plans to retire them.

Lee Neely

At the root of this recommendation is the fact that many Exchange servers remain unpatched worldwide allowing adversaries to exploit. I’m sorry but there is no other way around it, if you’re going to have effective cyber defense, you have to have a timely patch management process.

Curtis Dukes