CVE-2020-9885: 
macOS vulnerability analysis and mitigation

CVE-2020-9885 is a security vulnerability discovered in Apple's iMessage service that was disclosed and patched in July 2020. The vulnerability existed in the handling of iMessage tapbacks, where a user who was removed from an iMessage group could potentially rejoin the group without authorization. This issue affected multiple Apple operating systems including iOS 13.6, iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, and watchOS 6.2.8 (Apple iOS, Apple macOS).

The vulnerability was classified as an insufficient verification of data authenticity issue (CWE-345). According to the National Vulnerability Database, it received a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. The vulnerability stemmed from improper handling of iMessage tapbacks, which was subsequently resolved by implementing additional verification mechanisms (NVD).

The primary impact of this vulnerability was that it allowed unauthorized access to iMessage groups. Specifically, users who had been removed from an iMessage group could exploit this vulnerability to rejoin the group without permission, potentially compromising the privacy and security of group communications (Apple iOS).

The vulnerability required user interaction to exploit and could be triggered through the iMessage tapback feature. The attack complexity was considered low, requiring no special privileges for exploitation, though it did need local access to the system (NVD).

Apple addressed this vulnerability by implementing additional verification mechanisms in the handling of iMessage tapbacks. The fix was released in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, and watchOS 6.2.8. Users were advised to update their devices to these versions to protect against this vulnerability (Apple iOS, Apple macOS).