![\"Apple](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2013\/01\/Apple-Security-Update-Header.png\")
<\/p>\n<\/p>\n
Last week, Apple released updates to all of its operating systems. Apple released iOS 11.4, watchOS 4.3.1 and tvOS 11.4 two days prior to making available\u00a0macOS High Sierra 10.13.5 and other security updates for Sierra and El Capitan.\u00a0Because of the delay, Apple held back on the security release notes for the first three updates. Now that all the notes are available, let’s see what security fixes and improvements were included!<\/p>\n
For macOS High Sierra users, Apple’s latest security update addresses\u00a0the following:<\/p>\n
The macOS High Sierra 10.13.5 Update improves the stability, performance, and security of your Mac, and is recommended for all users.
\nThis update adds support for Messages in iCloud, which lets you store messages with their attachments in iCloud and free up space on your Mac. To enable Messages in iCloud, go to Preferences in Messages, click Accounts, then select \u201dEnable Messages in iCloud.\u201d
\nEnterprise content:<\/p>\n\n
- Variables used in SCEP payloads now expand properly.<\/li>\n
- Configuration profiles containing a Wi-Fi payload and SCEP payload install as expected when the
KeyIsExtractable<\/code> key of the SCEP payload is set tofalse<\/code>.<\/li>\n<\/ul>\n<\/blockquote>\nFor Sierra and El Capitan users, the updates simply mention the improvement of security and that it is recommended for all users. Of course, there is a lot more going on in these updates than the App Store mentions in its description, so let’s take a look.<\/p>\n
Between the three OS versions, a combined\u00a032 security related issues were addressed. Of these, 29 applied to High Sierra, 6 applied to Sierra, and 6 applied to El Capitan with most of them shared across multiple OS versions.<\/p>\n
\n<\/strong>Available for: macOS High Sierra 10.13.4
\nImpact: An attacker may be able to exfiltrate the contents of S\/MIME- encrypted e-mail
\nDescription: An issue existed in the handling of encrypted Mail. This issue was addressed with improved isolation of MIME in Mail.
\nCVE-2018-4227<\/p><\/blockquote>\nSecurity
\n<\/strong>Available for: macOS High Sierra 10.13.4
\nImpact: Users may be tracked by malicious websites using client certificates
\nDescription: An issue existed in the handling of S-MIME certificaties. This issue was addressed with improved validation of S-MIME certificates.
\nCVE-2018-4221<\/p><\/blockquote>\nYou may have heard the recent news that email encryption was found to be vulnerable. An attacker could potentially read content that should be secured by encryption. The above security fix does not appear to address the same vulnerability, though. Whereas the S\/MIME\/PGP encryption vulnerabilities were assigned CVE numbers CVE-2017-17688 and CVE-2017-17689, Apple’s security notice mentioned<\/a> patching CVE-2018-4227 and CVE-2018-4221, which do not appear to have any data publicly available. It could be related or it could be something completely different, and so certainly something to keep an eye on.<\/p>\n
Messages
\n<\/strong>Available for: macOS High Sierra 10.13.4
\nImpact: A local user may be able to conduct impersonation attacks
\nDescription: An injection issue was addressed with improved input validation.
\nCVE-2018-4235<\/p>\nImpact: Processing a maliciously crafted message may lead to a denial of service
\nDescription: This issue was addressed with improved message validation.
\nCVE-2018-4240<\/p><\/blockquote>\nTwo welcome vulnerability fixes for Messages, most notably a fix for the “Black dot bug<\/a>” that could cause a device to crash. While I have not seen this bug affect macOS, Apple saw fit to patch this across all OS versions just to be safe.<\/p>\n
Apple also included several graphics related fixes for AMD, NVIDIA, Intel, Graphics Drivers and iOGraphics in which\u00a0an application may have been able to exploit vulnerabilities to read restricted memory or execute code with root privileges.<\/p>\n
The Kernel got some fixes as well that protect against vulnerabilities, which could lead to denial of service attacks and root code executions.<\/p>\n
Last but not least, new firmware is included that protects your Mac from unwanted or unauthorized firmware modifications made by malicious applications.<\/p>\n
If you want to see more details about this update, have a look here<\/a>, it is a thrilling albeit rather nerdy read!<\/p>\n
Where to obtain\u00a0these updates<\/strong><\/h4>\n
On a High Sierra, Sierra or El Capitan system, simply open the App Store<\/strong> and check the Updates tab<\/strong>. The updates appropriate for your system will be listed there.<\/p>\n
If you prefer a manual download and install, here are the links to the downloads:<\/p>\n
\n
- macOS 10.13.5 update<\/a> – For High Sierra users currently running 10.13.4<\/li>\n
- macOS 10.13.5 combo update<\/a> – For High Sierra users running 10.13 – 10.13.4<\/li>\n
- Security Update 2018-003 (Sierra)<\/a> – For all users of macOS 10.12 Sierra<\/li>\n
- Security Update 2018-003 (El Capitan)<\/a> – For all users of macOS 10.11 El Capitan<\/li>\n<\/ul>\n
Safari 11.1.1<\/h3>\n
Safari 11.1.1\u00a0is included in the 10.13.5 update for High Sierra users, and also available as a separate download for macOS Sierra and OS X El Capitan users. A combined\u00a013 security issues were addressed in Safari 11.1.1. According to Apple’s security notice<\/a>, these issues could lead to address bar spoofing, denial of service arbitrary code execution. Two of the fixes were for the application itself and the rest were all for WebKit.<\/p>\n
For the full list of addressed issues, have a look here<\/a>.<\/p>\n
Where to obtain\u00a0this update<\/strong><\/h4>\n
As mentioned, High Sierra users will find Safari 11.1.1 built into the above mentioned 10.13.5 update. Sierra and El Capitan users can grab Safari 11.1.1\u00a0by opening the App Store<\/strong> and visiting the Updates tab<\/strong>.<\/p>\n
iOS 11.4<\/h3>\n
Not just a security update, iOS 11.4 sports a few new features and improvements, including AirPlay 2, HomePod stereo pair and Messages in iCloud. There are bug fixes as well, and you can read about all of them right here<\/a>. When it comes to security, 35 issues were addressed, including the Mail S\/MIME vulnerabilities mentioned earlier.<\/p>\n
Ten\u00a0of the security fixes were for WebKit, 3 for Siri and 3 for the Kernel. Other fixes included:<\/p>\n
Contacts
\n<\/strong>Impact: Processing a maliciously crafted vcf file may lead to a denial of service
\nDescription: A validation issue existed in the handling of phone numbers. This issue was addressed with improved validation of phone numbers.
\nCVE-2018-4100<\/p><\/blockquote>\niBooks<\/strong>
\nImpact: An attacker in a privileged network position may be able to spoof password prompts in iBooks
\nDescription: An input validation issue was addressed with improved input validation.
\nCVE-2018-4202<\/p><\/blockquote>\nUIKit<\/strong>
\nImpact: Processing a maliciously crafted text file may lead to a denial of service
\nDescription: A validation issue existed in the handling of text. This issue was addressed with improved validation of text.
\nCVE-2018-4198<\/p><\/blockquote>\nFor the full list of security fixes in this update, have a look here<\/a>.<\/p>\n
iOS 10.4 is available for iPhone 5s and later, iPad Air and later, and iPod touch 6th generation and can be downloaded over the air by going to Settings<\/strong> > General<\/strong> > Software Update<\/strong>. You can also connect your iOS device to your Mac and let iTunes do the update for you.<\/p>\n
watchOS 4.3.1<\/h3>\n
Listed as an update that adds and improves the following:<\/p>\n
\n
- Control volume and playback on HomePod from your Apple Watch<\/li>\n
- Restores ability to control music on iPhone<\/li>\n
- Use any orientation for Nightstand charging mode<\/li>\n
- Siri watch face now shows progress towards closing Activity rings and when new songs are added to Apple Music mixes<\/li>\n
- Resolves an issue where Activity achievements were incorrectly awarded for some users<\/li>\n
- Fixes an issue where Siri music commands were not working for some audio devices<\/li>\n<\/ul>\n
The update also addresses 20 security related issues, many the same as those found in iOS 11.4. The full list can be seen here<\/a>.<\/p>\n
watchOS 4.3.1 is available for all Apple Watch models and can be installed by connecting the watch to its charger, then on the iPhone open the Apple Watch app<\/strong> > My Watch tab<\/strong> > General<\/strong> > Software Update<\/strong>.<\/p>\n
tvOS 11.4<\/h3>\n
\nThis update includes general performance and stability improvements and this feature:<\/p>\n
AirPlay 2: Listen to your favorite songs across every Apple TV, HomePod, and AirPlay 2-compatible speaker you have in your home. Or play something different in every room at the same time.<\/p><\/blockquote>\n
Security wise, there were 24 issues addressed, again much similar to those addressed in iOS 11.4 and watchOS 4.3.1. The full list can be seen here<\/a>.<\/p>\n
The tvOS update is available for Apple TV 4K and Apple TV (4th generation) and can be downloaded directly from the Apple TV by going to Settings<\/strong> > System<\/strong> > Update Software<\/strong>.<\/p>\n
Before you update…<\/h3>\n
As always, make sure to backup your Mac and iOS device before installing any updates.\u00a0After backing up your data,\u00a0install these updates as soon as you can to ensure\u00a0protection from exploits that may leverage these known vulnerabilities. Backing up your Mac is a breeze with Time Machine or Intego Personal Backup<\/a>, and backing up your iOS device can be done easily<\/a> as well.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
Last week, Apple released updates to all of its operating systems. Apple released iOS 11.4, watchOS 4.3.1 and tvOS 11.4 two days prior to making available\u00a0macOS High Sierra 10.13.5 and other security updates for Sierra and El Capitan.\u00a0Because of the delay, Apple held back on the security release notes for the first three updates. Now […]<\/p>\n","protected":false},"author":79,"featured_media":55957,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[5],"tags":[4216,4207,4195,4204,4201,4198,4213,4210],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\n\n\t\n\t\n\t\n