3 ms·
Important point buried waaay at the bottom: -- The vulnerability allows to run remote code in the context of MobileMail (iOS 12) or maild (iOS 13). Successful e
by djrogers 7y ago
Important point buried waaay at the bottom:
--
The vulnerability allows to run remote code in the context of MobileMail (iOS 12) or maild (iOS 13). Successful exploitation of this vulnerability would allow the attacker to leak, modify, and delete emails. Additional kernel vulnerability would provide full device access
--
This is not a full-device/root RCE, and the sandbox / ASLR does work to contain this.
- creato 7y agoIs that really that important when email data will often be the primary target of the attacker?
- NikolaeVarius 7y agoYes? Details on what the scope of a issue is pretty damn important.
- deleted 7y ago[deleted]
- lawnchair_larry 7y agoThere is a good chance that the attackers have this capability also. It would be an additional component of an exploit chain. The authors did not investigate this.
- geonic 7y agoIs it possible to use the exploit to send e-mails From the compromised device? I’ve had a problem with lots of bounce mails today on one of my accounts. Apparently somebody used my SMTP for spam which I find hard to believe since I keep my password safe. It’s not part of any known public data set.