Hello and welcome to the Wednesday, April 2nd, 2025
edition of the SANS Internet Storm Center's Stormcast. My
name is Johannes Ullrich and today I'm recording from
Jacksonville, Florida. Yesterday, Apple released
updates, well, for almost everything. There were updates
for iOS, iPadOS, WatchOS, TVOS, MacOS, VisionOS, Safari,
and Xcode. The one thing that was missing from this lineup
was WatchOS, but that actually just got released a couple of
hours ago. Overall, we got updates for 145 different
vulnerabilities, if I counted them correctly. Many of these
vulnerabilities apply to multiple products because they
all sort of share the same kernel and with that good
amount of code. There are two interesting vulnerabilities
here I want to point out. These vulnerabilities were
already exploited in the wild, so-called zero-day
vulnerabilities. They had been patched in the most recent
versions of MacOS and iOS in the past, but now we got
patches for older versions of the operating system. There is
a WebKit vulnerability that was patched now for iOS,
iPadOS, and then there was a USB restriction vulnerability
that was patched for MacOS. Again, these were already
patched for the newer versions, but now this patch
was also offered for the older versions of MacOS. I mentioned
that you may have issues downloading the WatchOS
update. At least that's my experience so far and in the
DShield Slack. Another user already mentioned some issues
with that as well. There is something to keep in mind that
this is also a feature update. The iOS and MacOS updates
yesterday did enable some of Apple's AI features for
Europe. Once users start using that, this will actually
require a large multi-gigabyte download of the AI models. My
suspicion is that this just led probably to a little bit
more stress than normal on Apple servers. Also, the
WatchOS update was literally released a couple hours ago.
Initially, there are always some delays in getting them
pushed out to all the front -end servers and such. So,
yeah, if you have some issues downloading that Apple Watch
update, try it again tomorrow. It should work better. Other
than that, there isn't really anything super critical here
in these updates. So, applying it tomorrow by the end of the
week should be perfectly fine. Unless you're using one of
these older versions of iOS, MacOS. Which usually means
you're also using older hardware. Then, because of
these, I still call them serodei vulnerabilities. But,
of course, they have now been known and patched for newer
versions for quite a while. Because of that, you may want
to accelerate that a little bit. But I haven't seen any
sort of widespread exploit of these vulnerabilities at this
point. And if you're using VMware Workstation, there is
an issue that apparently is affecting VMware Workstation
users trying to check for updates. With all the
transition that VMware and prodcom are going through with
respect to URLs and such. They apparently messed up the URL
that's being used to check if there is a new version of
VMware available. You may see some certificate errors here,
apparently. So, I guess they'll wait for them to fix
it. Hopefully, sometime soon. But until then, if there are
any updates for VMware Workstation, you can still
install them. You can still download them. But there is no
mechanism right now to sort of get automatically alerted of
any updates. And then there is an interesting vulnerability
in the programming language NIM. If it's being used with
Postgres. And the reason I'm covering this is not because
the name is super popular and such. But I think it
illustrates a nice problem that sometimes happens if
you're using sort of not too much abstraction around
database libraries. Best practice if you're trying to
avoid SQL injection is to use prepared statements. The
problem is that your programming language or the
library that you're using may represent something as a
prepared statement that's actually not a prepared
statement. In my definition of prepared statements, it means
that the statement is being sent to the database separate
from the data. Now, what happens in NIM here is that
the language, the NIM Postgres interface here, is
actually escaping the parameters, building dynamic
SQL strings, and then sending them to the database as a
string. So, it's sort of a little bit of fake prepared
statements. Like, you know, Perl has done that way back in
the day with old versions of MySQL and such that didn't
support prepared statements natively. The problem here is
that, well, they're not doing it correctly under certain
circumstances. In particular, if in Postgres you set
standard conforming strings to off, the default is on and it
basically enforces some standards around how strings
are formatted. For compatibility reasons, as the
vulnerability note here points out, that's often turned off
and as a result, you may be vulnerable in this case. So,
interesting vulnerability and I think something to just be
aware of just because it looks like a prepared statement may
not mean that it actually is a prepared statement. And you
may still rely on some library here to actually do the right
thing as they are translating your data. Well, and that's it
for today. I hope I didn't fall for any April 1st
stories. I actually had one story about some Gmail end-to
-end encryption feature that didn't quite sort of pass the
smell test. If it turns out to be right, I may cover it
tomorrow. Other than that, remember, I'm also teaching
classes. And on the Stormcast page, you can also find links
to that next upcoming moment. It's actually in Orlando, just
here. So, if you're living somewhere up north, probably
nice to enjoy the sun a little bit and then also San Diego in
May. Anyway, that's it for today. Thanks for listening
and talk to you again tomorrow. Bye.
