CVE-2016-1852

Vulnerability

Siri in Apple iOS before 9.3.2 does not block data detectors within results when the device is in the lock-screen state. This allows a physically proximate attacker to obtain sensitive contact and photo information via unspecified vectors. The issue is addressed in iOS 9.3.2, affecting iPhone 4s and later, iPod touch (5th generation) and later, and iPad 2 and later [1].

Exploitation

An attacker with physical proximity to an unlocked but locked-screen device can invoke Siri and interact with data detectors in search results. No authentication or special permission is required beyond physical access to the device. The exact sequence of steps is not detailed by Apple but relies on the data detectors being active while the device is locked [1].

Impact

A successful exploitation allows a physically proximate attacker to gain access to sensitive contact information and photos stored on the device, potentially compromising user privacy. The attacker does not need to unlock the device, bypassing the lock-screen protection [1].

Mitigation

The vulnerability is fixed in iOS 9.3.2, released on May 16, 2016 [1]. Users should update their devices to iOS 9.3.2 or later. No workarounds are provided by Apple, and the issue is not listed on CISA's Known Exploited Vulnerabilities catalog.