‘Quicksand’ – A New Enterprise iOS Vulnerability

"Earlier this year the Appthority Enterprise Mobility Threat Team discovered a previously unknown sandbox violation (0-day) within Apple’s iOS. [...] The underlying issue with our critical sandbox violation discovery is that not only can a mobile app (or the MDM vendor app itself) have access to this sensitive set-up and authentication information stored on the device, but anyone (or any other app on the device) can also see the credential information on the mobile device as it is stored ‘world readable’. We’ve worked directly with the Apple Security Team since this was discovered leading to the fix rolled in the latest iOS update (8.4.1)."

[ ‘Quicksand’ – A New Enterprise iOS Vulnerability