Bluetooth in Apple OS X before 10.10 does not require encryption for HID Low Energy devices, which allows remote attackers to spoof a device by leveraging previous pairing.

According to its banner, the remote Apple TV device is a version prior to 7.0.1. It is, therefore, affected by the following vulnerabilities :

  - An error exists related to the way SSL 3.0 handles     padding bytes when decrypting messages encrypted using     block ciphers in cipher block chaining (CBC) mode. A     man-in-the-middle attacker can decrypt a selected byte     of a cipher text in as few as 256 tries if they are able     to force a victim application to repeatedly send the     same data over newly created SSL 3.0 connections. This     is also known as the 'POODLE' issue. (CVE-2014-3566)

  - A error exists that permits unencrypted connections for     Human Interface Device (HID) class Bluetooth Low Energy     accessories. This allows a local attacker to spoof     another legitimate Bluetooth device to bypass pairing.
    (CVE-2014-4428)

Versions of Apple TV earlier than 7.0.1 are unpatched for two vulnerabilities:

  - SSL protocol 3.0 uses nondeterministic CBC padding, which exposes it to man-in-the-middle attacks (aka, the "POODLE" issue); the issue was fixed by disabling CBC cipher suites from use when TLS connection attempts fail (CVE-2014-3566)
  - Unencrypted Bluetooth input are allowed, which could be leveraged by an attacker to spoof Bluetooth connections; the issue was fixed by disallowing unencrypted connections (CVE-2014-4428)

According to its banner, the remote iOS device is missing a security update.  Versions of Apple iOS prior to 8.1 are affected by vulnerabilities within the following components :

  - Bluetooth
  - House Arrest
  - iCloud Data Access
  - Keyboards
  - Secure Transport

Apple OS X 10.10 (Yosemite) contains fixes for the following components: 
  - 802.1X
  - AFP File Server
  - App Sandbox
  - Bash
  - Bluetooth
  - CFPreferences
  - CUPS
  - Certificate Trust Policy
  - CoreStorage
  - Dock
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - Kernel
  - LaunchServices
  - LoginWindow
  - MCX Desktop Config Profiles
  - Mail
  - NetFS Client Framework
  - QuickTime
  - Safari
  - Secure Transport
  - Code Signing
  - Security
  - apache
  - fdesetup
  - iCloud Find My Mac

The mobile device is running a version of iOS prior to version 8.1. It is, therefore, affected by vulnerabilities in the following components :

  - Bluetooth
  - House Arrest
  - iCloud Data Access
  - Keyboards
  - Secure Transport

The remote host is running a version of Mac OS X is prior to version 10.10. This update contains several security-related fixes for the following components :

  - 802.1X
  - AFP File Server
  - apache
  - App Sandbox
  - Bash
  - Bluetooth
  - Certificate Trust Policy
  - CFPreferences
  - CoreStorage
  - CUPS
  - Dock
  - fdesetup
  - iCloud Find My Mac
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - Kernel
  - LaunchServices
  - LoginWindow
  - Mail
  - MCX Desktop Config Profiles
  - NetFS Client Framework
  - QuickTime
  - Safari
  - Secure Transport
  - Security
  - Security - Code Signing

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	Name	Product	Family	Severity
78871	Apple TV < 7.0.1 Multiple Vulnerabilities (POODLE)	Nessus	Misc.	low
8562	Apple TV < 7.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Internet Services	low
8560	Apple iOS < 8.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
8555	Mac OS X < 10.10 Multiple Vulnerabilities (APPLE-SA-2014-10-16-1 OS X Yosemite v10.10)	Nessus Network Monitor	Web Clients	critical
78585	Apple iOS < 8.1 Multiple Vulnerabilities (POODLE)	Nessus	Mobile Devices	medium
78550	Mac OS X < 10.10 Multiple Vulnerabilities (POODLE) (Shellshock)	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2014-4428

high

Tenable Plugins

low

low

high

critical

medium

critical