Stagefright-Like Exploit Discovered in iOS, OS X, tvOS, and watchOS – Latest Updates Fix the Flaw

Posted in Apple News, Apple TV, Apple Watch, iOS, OS X on 22/07/2016 by Chris Hauk


Here’s another entry to add to your list entitled “Reasons Why I should be Running the Latest Versions of Apple’s Operating Systems on my Devices.” A Stagefright-like security hole has been found in iOS, OS X, tvOS, and watchOS. However, the latest versions of all operating systems fix the flaw.

Stagefright-Like Exploit Discovered in iOS, OS X, tvOS, and watchOS - Latest Updates Fix the Flaw

The bug, which is similar to last year’s Stagefright bug which afflicted Android devices, and could allow an attacker access to a device’s stored passwords and files simply by sending a user a malicious image file.


Cisco Talos senior security researcher Tyler Bohan found the critical bug in ImageIO, which is used to handle image data. An attacker could create an exploit – a little program that takes advantage of vulnerabilities – and send it via a multimedia message (MMS) inside a Tagged Image File Format (TIFF). Once received, the hack would launch. The user would have no chance of detecting the attack, which would begin to write code beyond the normal permitted boundaries of an iPhone’s texting tool.

Safari users are also vulnerable to the attack, as all a user would need to do is visit a website containing the malicious code, and the browser itself would parse the exploit, no interaction with the site on the user’s part would be required.

Apple has patched the flaw in its latest versions of the affected operating systems, which were all updated on Monday to the following versions: OS 9.3.3, OS X 10.11.6, tvOS 9.2.2 and watchOS 2.2.2, all of which patch the bug. Apple hasn’t yet released patches for either Mavericks or Yosemite.

As pointed out by MacWorld, this is all simply proof of concept at this stage. No exploits of the flaw have been found in the wild. Additionally, while infection by a malicious webpage was demonstrated by Cisco, MMS and iMessage have so far only been shown to be a potential risk. Cisco hasn’t yet proven that the exploit works in the real world. (Via 9to5Mac)

Details on all 43 flaws addressed in 9.3.3 can be found in Apple’s advisory. The company also released advisories for iTunes on Windows, SafaritvOSwatchOS, and OS X El Capitan.


Chris Hauk

MacTrast Senior Editor, and self-described "magnificent bastard," Chris Hauk owns Phoenix Rising Services and writes for everyone's favorite "bad movie" website, Big Bad Drive-In.

His first Apple product was an iPod Classic 9 years ago, and he has since added a MacBook Pro, a number of iPads, iPhones, and multiple Apple TVs to his collection.

He lives somewhere in the deep Southern part of America. Yes, he has to pump in both sunshine and the Internet.