CVE-2019-8856 Explained : Impact and Mitigation

A vulnerability in the handling of outgoing phone calls initiated with Siri on Apple devices could lead to calls being made using the wrong cellular plan. This issue has been addressed in various software updates.

Understanding CVE-2019-8856

What is CVE-2019-8856?

An API issue existed in the handling of outgoing phone calls initiated with Siri, which could result in calls being made using the incorrect cellular plan on devices with two active plans.

The Impact of CVE-2019-8856

The vulnerability could potentially lead to privacy concerns and unexpected charges for users if calls are made using the wrong cellular plan.

Technical Details of CVE-2019-8856

Vulnerability Description

The problem was related to the handling of outgoing phone calls initiated with Siri, which has been resolved by improving state management.

Affected Systems and Versions

iOS and iPadOS versions less than 13.3
macOS versions less than 10.15
macOS versions less than 6.1

Exploitation Mechanism

Siri could initiate calls using the incorrect cellular plan on devices that have two active plans.

Mitigation and Prevention

Immediate Steps to Take

Update affected devices to the latest software versions that include the necessary fixes.
Be cautious when making outgoing calls using Siri on devices with multiple active plans.

Long-Term Security Practices

Regularly update your Apple devices to ensure they are protected against known vulnerabilities.
Monitor your cellular plan usage to detect any unusual activity.

Patching and Updates

Apply the following updates to mitigate the vulnerability:

iOS 13.3 and iPadOS 13.3
watchOS 6.1.1
macOS Catalina 10.15.2
Security Update 2019-002 Mojave
Security Update 2019-007 High Sierra