CVE-2018-4249 : An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves pktmnglr_ipfilter_input in com.apple.packet-mangler in the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (integer overflow and stack-based buffer overflow) via a crafted app.

Published 2018-06-08 18:29:03

Updated 2023-06-12 07:15:10

Source Apple Inc.

View at NVD, CVE.org

Vulnerability category: OverflowMemory CorruptionExecute codeDenial of service

Threat overview for CVE-2018-4249

Top countries where our scanners detected CVE-2018-4249

Top open port discovered on systems with this issue 548

IPs affected by CVE-2018-4249 360

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2018-4249!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2018-4249

Probability of exploitation activity in the next 30 days: 0.45%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 75 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2018-4249

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2018-4249

CWE-190 Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

Assigned by: nvd@nist.gov (Primary)
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-4249

https://support.apple.com/HT208850

About the security content of tvOS 11.4 - Apple Support
Vendor Advisory

CVEs referencing this url
https://lgtm.com/blog/apple_xnu_packet_mangler_CVE-2017-13904

CVE-2018-4249 & CVE-2017-13904: Remote code execution in Apple's packet mangler | Semmle Blog
Exploit;Mitigation;Third Party Advisory
https://support.apple.com/HT208851

About the security content of watchOS 4.3.1 - Apple Support
Vendor Advisory

CVEs referencing this url
http://packetstormsecurity.com/files/172828/Apple-packet-mangler-Remote-Code-Execution.html

Apple packet-mangler Remote Code Execution ≈ Packet Storm

CVEs referencing this url
https://support.apple.com/HT208849

About the security content of macOS High Sierra 10.13.5, Security Update 2018-003 Sierra, Security Update 2018-003 El Capitan - Apple Support
Vendor Advisory

CVEs referencing this url
https://support.apple.com/HT208848

About the security content of iOS 11.4 - Apple Support
Vendor Advisory

CVEs referencing this url
http://www.securitytracker.com/id/1041027

Apple macOS/OS X Multiple Flaws Let Remote Users Execute Arbitrary Code and Deny Service and Let Local Users Obtain Potentially Sensitive Information, Bypass Security, and Gain Elevated Privileges - S
Third Party Advisory;VDB Entry

CVEs referencing this url

Products affected by CVE-2018-4249