Uri Katz

A Padding Oracle flaw exists in the `EncryptInterceptor` when using its default configuration. This issue stems from the use of Cipher Block Chaining (CBC) and deficiencies in the error reporting mechanism. A remote attacker can exploit these weaknesses in the encryption padding to decrypt sensitive information and gain unauthorized access to confidential data.

A buffer overflow issue was addressed by improving input validation. This could allow an attacker on the local network to cause an unexpected termination of the application.

The issue was addressed with improved checks. An attacker on the local network may cause an unexpected app termination.

A use-after-free issue exists due to improper memory management. This issue allows a remote attacker to potentially corrupt process memory. The vulnerability is actively exploited and enables zero-click remote code execution via the AirPlay protocol. An attacker on the local network may be able to compromise devices. The vulnerability affects multiple Apple operating systems, including macOS, tvOS, iPadOS, iOS, and visionOS. Exploitation of this issue can lead to malware installation without user interaction and has the potential to spread across networks. A demonstration of the exploit targeting the Apple Music App is available.

The issue was addressed with improved checks. An attacker on the local network may cause an unexpected app termination.

An access control issue was identified within the AirPlay Handler component of Apple operating systems. This issue allows an unauthenticated user on the same network as a signed-in device to send AirPlay commands without proper pairing. The issue impacts the confidentiality and integrity of the affected systems. Reports indicate that this issue has been actively exploited, potentially enabling unauthorized access and control. The vulnerability allows for unauthenticated command execution due to an Access Control List bypass.

An attacker on the local network may be able to leak sensitive user information. The issue was addressed by removing the vulnerable code.

An authentication issue was addressed with improved state management. This issue allows an attacker on the local network to bypass authentication policy.

A null pointer dereference issue was addressed through improved input validation. An attacker on the local network could cause a denial-of-service.

A type confusion issue was addressed with improved checks. An attacker on the local network may cause an unexpected app termination.

The issue is related to an integer overflow that was addressed with improved input validation. An attacker on the local network may be able to cause a denial-of-service.

A null pointer dereference issue was addressed through improved input validation. An attacker on the local network may cause a denial-of-service.

The issue is related to a null pointer dereference in the implementation of AirPlay technology in macOS, iOS, and iPadOS operating systems. This could allow a remote attacker to cause a denial-of-service.

A type confusion issue was addressed with improved checks. This issue may allow a remote attacker to cause an unexpected app termination. The vulnerability is related to the AirPlay protocol and can be exploited through the `/getProperty` API endpoint using the `POST` method. Examples of attack outcomes include distracting drivers through image display and playing audio, or potentially actions like eavesdropping on conversations and tracking a vehicle's location. Crashing the AirPlay server creates an opening for a man-in-the-middle attack.

An input validation issue was addressed, which could allow an attacker on the local network to cause unexpected system termination or corrupt process memory. The issue is also related to a buffer overflow vulnerability in the implementation of the AirPlay technology in the affected operating systems, which could be exploited by a remote attacker to cause a denial of service or execute arbitrary code.

A type confusion issue was addressed with improved checks. This issue may allow a remote attacker to cause an unexpected application termination or arbitrary code execution.

The issue is related to a buffer overflow in memory due to improper handling of the AirPlay technology implementation in the affected operating systems. An attacker in a privileged position may be able to perform a denial-of-service. The problem was solved by improving memory management.

Name of the Vulnerable Software and Affected Versions: Snap One OVRC cloud (affected versions not specified) Description: A vulnerability exists in the Snap One OVRC cloud, allowing an attacker to impersonate a Hub device and send requests to claim and unclaim devices. The attacker only needs to provide the MAC address of the targeted device. This issue is related to the possibility of sending requests to the database without passing the authentication procedure, which can allow a remote attacker to gain unauthorized access to add or remove network devices. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Snap One OVRC cloud (affected versions not specified) Description: The issue concerns the use of MAC addresses as identifiers in the Snap One OVRC cloud, allowing an attacker to impersonate other devices by supplying enumerated MAC addresses and potentially receive sensitive information about the device. This could lead to unauthorized access to protected information. An attacker can exploit this by spoofing MAC addresses due to incorrect handling, enabling remote unauthorized access to sensitive data. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is an OS command injection vulnerability that may allow a user with limited-access SSH session to escalate their privileges to root-level access.