San Francisco, April 23: Security researchers at cybersecurity company ZecOps have discovered two vulnerabilities which they believe are widely exploited in the wild to target iPhone and iPad users. The researchers discovered the bugs in the default iOS and iPadOS Mail app. The bugs allow to run remote code in the context of MobileMail (iOS 12) or maild (iOS 13). Successful exploitation of this vulnerability would allow the attacker to leak, modify, and delete emails. Apple iPhone SE Plus Might Be Launched in the Second Half of Next Year: Report.

"Additional kernel vulnerability would provide full device access -- we suspect that these attackers had another vulnerability. It is currently under investigation," the San Francisco-based ZecOps said on Wednesday.

What is more, on iOS 13, end users do not require to perform any action for the exploitation to succeed. On iOS 12, the bug requires the victim to click on an email. If an attacker controls the mail server, the attack can be performed without any clicks on iOS 12 too, the researchers said. Once the vulnerabilities are triggered or exploited, users should not observe any anomalous behaviour besides a temporary slowdown of mobile mail application, the researcher said.

When the exploit fails on iOS 12 -- users may notice a sudden crash of the Mail application. On iOS13, besides a temporary slowdown, it would not be noticeable. Failed attacks would not be noticeable on iOS 13 if another attack is carried afterwards and deletes the email, they added. Google Meet App Gets Updated With 4 New Features Including Zoom-Like Gallery View With 16 Video Call Participants.

"With very limited data we were able to see that at least six organisations were impacted by this vulnerability – and the potential abuse of this vulnerability is enormous," ZecOps said in a blog post .

iOS is vulnerable to these bugs at least since iOS 6 –September 2012, ZecOps said, adding that it did not check earlier versions. MacOS is not vulnerable to these bugs, it added. Following the discovery of the vulnerabilities, ZecOps said it alerted Apple in February. Apple has patched both the bugs in the latest beta releases of iOS 13, while a fix is set to arrive in the next publicly available iOS update in iOS and iPadOS 13.4.5, reports AppleInsider.

"The newly released beta update of 13.4.5 contains a patch for these vulnerabilities. If you cannot patch to this version instead of using Mail application consider to use other mail applications until a GA patch is available," ZecOps said.

(The above story first appeared on LatestLY on Apr 23, 2020 12:14 PM IST. For more news and updates on politics, world, sports, entertainment and lifestyle, log on to our website latestly.com).