CERT-In issues severe warning on critical Apple vulnerabilities

The Indian Computer Emergency Response Team (CERT-In) issued a critical advisory on August 2, warning of severe security vulnerabilities in various Apple products. The vulnerabilities, described as “high-risk,” affect iPhones, iPads, Macs, and other Apple devices.

The advisory specifies that the affected software versions include:

•    iOS and iPadOS: Versions prior to 17.6 and 16.7.9
•    macOS: Versions prior to 14.6 (Sonoma), 13.6.8 (Ventura), and 12.7.6 (Monterey)
•    watchOS: Versions prior to 10.6
•    tvOS: Versions prior to 17.6
•    visionOS: Versions prior to 1.3
•    Safari: Versions prior to 17.6

CERT-In highlighted that these vulnerabilities could enable attackers to access sensitive information, execute arbitrary code, bypass security restrictions, cause denial of service (DoS), and perform spoofing attacks. The advisory strongly urges all Apple users to install the latest software updates immediately to address these vulnerabilities and mitigate potential risks.

In a related issue, Apple has also alerted users about potential “mercenary spyware attacks,” similar to the Pegasus spyware. These alerts have been sent to users in over 150 countries, including India. Prominent figures such as Iltija Mufti, media adviser and daughter of former Jammu and Kashmir Chief Minister Mehbooba Mufti, and Pushparaj Deshpande, founder of Samruddha Bharat Foundation, have reported receiving these warnings.

The Ministry of Electronics and Information Technology (MeitY) and Apple have not yet responded to inquiries regarding these issues. Meanwhile, CERT-In monitors the situation and advises users to stay updated with the latest security patches. The central government’s advisory stresses the high risk of these vulnerabilities and the urgency for users to secure their devices promptly.