A security researcher has warned that Apple has not fixed three zero-day vulnerabilities discovered in iOS 15.
An unknown researcher publicly released on GitHub proof-of-concept exploit code for three iOS zero-day vulnerabilities and one flaw addressed by Apple in July.
The unknown researcher who found the four zero-days reported them to Apple between March 10 and May 4. However, the company silently patched one of them in July with the release of 14.7 without giving credit in the security advisory.
“When I confronted them, they apologized, assured me it happened due to a processing issue and promised to list it on the security content page of the next update,” security researcher illusionofchaos wrote in a blog post published today. “There were three releases since then and they broke their promise each time.”
One issue reportedly lets any app installed from the App Store access a user’s Apple ID email and full name, Apple ID authentication token, a database containing contact information and interaction records, and the Speed Dial and Address Book database including things like contact pictures. Another vulnerability “allows any user-installed app to determine whether any app is installed on the device given its bundle ID.” The final zero-day bug “makes it possible for any qualifying app (e.g. possessing location access authorization) to gain access to Wifi information without the required entitlement.”
illusionofchaos says they sent detailed reports to Apple in April of this year and was quickly informed Apple was investigating the issues. As noted, whilst one other problem has been fixed the aforementioned vulnerabilities all still persist, and Illusionofchaos says they haven’t received any reply from Apple as of today.
