Kaspersky Lab security researchers have discovered a new vulnerability in the kernel of Darwin – an open-source component of both the OS X and iOS operating systems. According to the researcher, this 'Darwin Nuke' vulnerability leaves OS X 10.10 and iOS 8 devices exposed to remotely-activated denial of service (DoS) attacks which can purportedly damage the user's device and impact any corporate network to which the device is connected.
To get rid of the vulnerability, the experts have suggested users to update their devices with the OS X 10.10.3 and iOS 8.3 software releases, which has already patched this vulnerability.
According to the Kaspersky Lab's analysis of the vulnerability, the devices affected by the threat include those with 64-bit processors and iOS 8 based devices such as iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad Air 2, iPad mini 2, and iPad mini 3.
The 'Darwin Nuke' vulnerability is exploited while processing an IP packet of specific size and with invalid IP options. Remote attackers can execute a DoS (denial of service) attack on a device with OS X 10.10 or iOS 8, sending an incorrect network packet to the target. After processing the invalid network packet, the system crashes. The researchers discovered that the system crashes if the IP packet meets the following conditions:
- The size of the IP header is 60 bytes.
- The size of the IP payload is less than or equal to 65 bytes.
- The IP options is incorrect (invalid option size, class, etc.)
"At first sight, it is very hard to exploit this bug, as the conditions attackers need to meet are not trivial ones. But persistent cybercriminals can do so, breaking down devices or even affecting the activity of corporate networks. Routers and firewalls would usually drop incorrect packets with invalid option sizes, but we discovered several combinations of incorrect IP options that are able to pass through the Internet routers. We'd like to warn all OS X 10.10 and iOS 8 users to update devices to OS X 10.10.3 and iOS 8.3 releases," says Anton Ivanov, senior malware analyst at Kaspersky Lab.
The researchers suggest users to use a web browser that has a solid track record of fixing security issues promptly, run "Software Update" and patch the machine promptly when updates are available, use a password manager to cope with phishing attacks and install a good security solution.
