WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, does not properly interpret Unicode encoding, which allows remote attackers to spoof a postMessage origin, and bypass intended restrictions on sending a message to a connected frame or window, via crafted characters in a URL.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, does not properly interpret Unicode     encoding, which allows remote attackers to spoof a postMessage origin, and bypass intended restrictions on     sending a message to a connected frame or window, via crafted characters in a URL. (CVE-2014-1346)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host has Safari installed that is older than 6.1.4 or 7.0.4, and is thus unpatched for the following WebKit vulnerabilities :

 - Multiple memory corruption issues within WebKit, which were addressed through improved memory handling (CVE-2013-2875, CVE-2013-2927, CVE-2014-1323, CVE-2014-1324, CVE-2014-1326, CVE-2014-1327, CVE-2014-1329, CVE-2014-1330, CVE-2014-1331, CVE-2014-1333, CVE-2014-1334, CVE-2014-1335, CVE-2014-1336, CVE-2014-1337, CVE-2014-1338, CVE-2014-1339, CVE-2014-1341, CVE-2014-1342, CVE-2014-1343, CVE-2014-1344, CVE-2014-1731)
 - An issue with the way unicode characters in the URL are handled could result in bypassing the browser's origin check (CVE-2014-1346)

The version of Apple Safari installed on the remote Mac OS X host is a version prior to 6.1.4 or 7.0.4. It is, therefore, potentially affected by the following vulnerabilities :

  - Multiple memory corruption vulnerabilities exist in     WebKit that could lead to unexpected program     termination or arbitrary code execution.
    (CVE-2013-2875, CVE-2013-2927, CVE-2014-1323,     CVE-2014-1324, CVE-2014-1326, CVE-2014-1327,     CVE-2014-1329, CVE-2014-1330, CVE-2014-1331,     CVE-2014-1333, CVE-2014-1334, CVE-2014-1335,     CVE-2014-1336, CVE-2014-1337, CVE-2014-1338,     CVE-2014-1339, CVE-2014-1341, CVE-2014-1342,     CVE-2014-1343, CVE-2014-1344, CVE-2014-1731)

  - An error exists related to unicode character handling     in URLs that could allow an attacker send an incorrect     'postMessage' origin that could allow a security bypass.
    (CVE-2014-1346)

ID	Name	Product	Family	Type	Severity
218063	Linux Distros Unpatched Vulnerability : CVE-2014-1346	Nessus	Misc.	Local	high
8264	Safari < 6.1.4 / 7.0.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		medium
74139	Mac OS X : Apple Safari < 6.1.4 / 7.0.4 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	high

Detections

Analytics

CVE-2014-1346

high

Tenable Plugins

high

medium

high