kextd in Kext Management in Apple iOS before 7 does not properly verify authorization for IPC messages, which allows local users to (1) load or (2) unload kernel extensions via a crafted message.

The remote host is running a version of Mac OS X that is older than 10.9 (dubbed OS X Maverick). The newer version contains numerous security-related fixes for the following components :

  - Application Firewall
  - App Sandbox
  - Bluetooth
  - CFNetwork
  - CFNetwork SSL
  - Console
  - CoreGraphics
  - curl
  - dyld
  - IOKitUser
  - IOSerialFamily
  - Kernel
  - Kext Management
  - LaunchServices
  - Libc
  - Mail Accounts
  - Mail Header Display
  - Mail Networking
  - OpenLDAP
  - perl
  - Power Management
  - python
  - ruby
  - Security
  - Security
  - Authorization
  - Security
  - Smart Card Services
  - Screen Lock
  - Screen Sharing Server
  - syslog
  - USB

The remote host is running a version of Mac OS X 10.x that is prior to version 10.9. The newer version contains multiple security-related fixes for the following components :

  - Application Firewall
  - App Sandbox
  - Bluetooth
  - CFNetwork
  - CFNetwork SSL
  - Console
  - CoreGraphics
  - curl
  - dyld
  - IOKitUser
  - IOSerialFamily
  - Kernel
  - Kext Management
  - LaunchServices
  - Libc
  - Mail Accounts
  - Mail Header Display
  - Mail Networking
  - OpenLDAP
  - perl
  - Power Management
  - python
  - ruby
  - Security
  - Security - Authorization
  - Security - Smart Card Services
  - Screen Lock
  - Screen Sharing Server
  - syslog
  - USB

According to its banner, the remote Apple TV 2nd generation or later device is prior to 6.0.  It is, therefore, reportedly affected by multiple vulnerabilities, the most serious issues of which could result in arbitrary code execution.

The mobile device is running a version of iOS that is older than version 7.  This version contains security-related fixes for the following components :

  - Certificate Trust Policy
  - CoreGraphics
  - CoreMedia
  - Data Protection
  - Data Security
  - dyld
  - File Systems
  - ImageIO
  - IOKit
  - IOKitUser
  - IOSerialFamily
  - IPSec
  - Kernel
  - Kext Management
  - libxml
  - libxslt
  - Passcode Lock
  - Personal Hotspot
  - Push Notifications
  - Safari
  - Sandbox
  - Social
  - Springboard
  - Telephony
  - Twitter
  - WebKit

According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS older than 7.0 are affected by vulnerabilities within the following components :

 - Certificate Trust Policy
 - CoreGraphics
 - CoreMedia
 - Data Protection
 - Data Security
 - File Systems
 - IOKit
 - IOKitUser
 - IOSerialFamily
 - IPSec
 - ImageIO
 - Kernel
 - Kext Management
 - Passcode Lock
 - Personal Hotspot
 - Push Notifications
 - Safari
 - Sandbox
 - Social
 - Springboard
 - Telephony
 - Twitter
 - WebKit
 - dyld
 - libxml
 - libxslt

ID	Name	Product	Family	Type	Severity
8040	Mac OS X < 10.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
70561	Mac OS X 10.x < 10.9 Multiple Vulnerabilities (BEAST)	Nessus	MacOS X Local Security Checks	Combined	high
70257	Apple TV < 6.0 Multiple Vulnerabilities	Nessus	Misc.	Remote	high
69984	Apple iOS < 7 Multiple Vulnerabilities	Nessus	Mobile Devices	Local	high
8013	Apple iOS < 7.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices		critical

Detections

Analytics

CVE-2013-5145

medium

Tenable Plugins

high

high

high

high

critical