Description
The issue was addressed by removing the relevant flags. This issue is fixed in iOS 18.2 and iPadOS 18.2, watchOS 11.2. A system binary could be used to fingerprint a user's Apple Account.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected products
- Apple / iOS and iPadOS0 – 18.2
- Apple / watchOS0 – 11.2
References
- VENDOR_ADVISORYhttps://support.apple.com/en-us/121837
- VENDOR_ADVISORYhttps://support.apple.com/en-us/121843