Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-4225: Apple devices let local user change keychain settings

CVE-2018-4225 · published 8 years ago

Summary

Older versions of iOS, macOS, watchOS, iCloud for Windows, and iTunes for Windows allow a person with access to the computer to bypass the normal limits on modifying the Keychain, which stores passwords and other secrets. This could let an unauthorized user alter or view stored credentials. Update the operating system and apps to the latest versions to close the gap.

What to do

Update apple iphone_os to version 11.4 or later.
Update apple mac_os_x to version 10.13.5 or later.
Update apple watchos to version 4.3.1 or later.
Update apple icloud to version 7.5 or later.
Update apple itunes to version 12.7.5 or later.

Affected software

Vendor	Product	Affected versions
apple	iphone_os	< 11.4 `cpe:2.3:o:apple:iphone_os::::::::`
apple	mac_os_x	< 10.13.5 `cpe:2.3:o:apple:mac_os_x::::::::`
apple	watchos	< 4.3.1 `cpe:2.3:o:apple:watchos::::::::`
apple	icloud	< 7.5 `cpe:2.3:a:apple:icloud::::::::`
apple	itunes	< 12.7.5 `cpe:2.3:a:apple:itunes::::::::`

Original advisory text

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. watchOS before 4.3.1 is affected. The issue involves the "Security" component. It allows local users to bypass intended restrictions on Keychain state modifications.

References

http://www.securityfocus.com/bid/104889 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041027 Third Party Advisory VDB Entry
https://support.apple.com/HT208848 Vendor Advisory
https://support.apple.com/HT208849 Vendor Advisory
https://support.apple.com/HT208851 Vendor Advisory
https://support.apple.com/HT208852 Vendor Advisory
https://support.apple.com/HT208853 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published8 Jun 2018

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2018-4225 · NVD

Track software like this

Free during beta