A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. The initiator of a Group FaceTime call may be able to cause the recipient to answer.

The version of Apple iOS running on the mobile device is prior to 12.1.4. It is, therefore, affected by multiple vulnerabilities:

 - A logic issue in the handling of Group FaceTime calls could allow the initiator to cause the recipient to answer. (CVE-2019-6223)

 - An unspecified memory corruption issue in Foundation could lead to an application gaining elevated privileges. (CVE-2019-7286)

 - An unspecified memory corruption issue in IOKit could lead to an application executing arbitrary code with kernel privileges.
 (CVE-2019-7287)

 - An unspecified issue with Live Photos in FaceTime.
 (CVE-2019-7288)

The remote host is running a version of macOS 10.14.3 that is missing the macOS 10.14.3 Supplemental Update.  This update fixes the following vulnerabilities :

  - An unspecified flaw exists related to handling Group     FaceTime calls that allows an attacker to cause a call     recipient to unintentionally answer. (CVE-2019-6223)

  - An input-validation flaw exists related to the     Foundation component that allows memory corruption and     privilege escalation. (CVE-2019-7286)

  - An unspecified flaw exists related to Live Photos in     FaceTime having unspecified impact. (CVE-2019-7288)

The version of Apple iOS running on the mobile device is prior to 12.1.4. It is, therefore, affected by multiple vulnerabilities:

  - A logic issue in the handling of Group FaceTime calls could allow     the initiator to cause the recipient to answer. (CVE-2019-6223)

  - An unspecified memory corruption issue in Foundation could lead     to an application gaining elevated privileges. (CVE-2019-7286)

  - An unspecified memory corruption issue in IOKit could lead to an     application executing arbitrary code with kernel privileges.
    (CVE-2019-7287)

  - An unspecified issue with Live Photos in FaceTime.
    (CVE-2019-7288)

ID	Name	Product	Family	Type	Severity
700557	Apple iOS < 12.1.4 Multiple Vulnerabilities (APPLE-SA-2019-2-07-1)	Nessus Network Monitor	Mobile Devices		high
122508	macOS 10.14.3 Supplemental Update	Nessus	MacOS X Local Security Checks	Combined	critical
121645	Apple iOS < 12.1.4 Multiple Vulnerabilities	Nessus	Mobile Devices	Local	critical

Detections

Analytics

CVE-2019-6223

high

Tenable Plugins

high

critical

critical