WindowServer in Apple OS X through 10.9.2 does not prevent session creation by a sandboxed application, which allows attackers to bypass the sandbox protection mechanism and execute arbitrary code via a crafted application.

The remote host is running a version of Mac OS X that is older than 10.9.3, and is thus missing security-related fixes for the following components:

  - CFNetwork HTTPProtocol
  - CoreServicesUIAgent
  - FontParser
  - Heimdal Kerberos
  - ImageIO
  - Intel Graphics Driver
  - IOKit Kernel
  - Kernel
  - Power Management
  - Ruby
  - Security
  - Secure Transport
  - Window Server

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.7, 10.8, or 10.9 that does not have Security Update 2014-002 applied. This update contains several security-related fixes for the following components :

  - CFNetwork HTTPProtocl
  - CoreServicesUIAgent
  - FontParser
  - Heimdal Kerberos
  - ImageIO
  - Intel Graphics Driver
  - IOKit Kernel
  - Kernel
  - Power Management
  - Ruby
  - Security - Secure Transport
  - Window Server

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

ID	Name	Product	Family	Severity
8265	Mac OS X < 10.9.3 Multiple Vulnerabilities (Security Update 2014-002)	Nessus Network Monitor	Web Clients	critical
73648	Mac OS X Multiple Vulnerabilities (Security Update 2014-002)	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2014-1314

critical

Tenable Plugins

critical

critical