IOSurface in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages "type confusion" during serialized-object handling.

According to its banner, the remote Apple TV device is missing a security update.  It is, therefore, affected by the following vulnerabilities :

 - There is a flaw in the way that the IOSurface component handles "type confusion" which would allow a remote attacker to execute arbitrary code as a privileged user. (CVE-2015-1061)
 - The MobileStorageMounter component allows attackers to create arbitrary filesystem locations. (CVE-2015-1062)
 - The Secure Transport component allows remote attackers to downgrade the encryption cipher. (CVE-2015-1067)

According to its banner, the remote Apple iOS device is missing a security update.  It is, therefore, affected by the following vulnerabilities :

 - There is a flaw in the way that the IOSurface component handles "type confusion" which would allow a remote attacker to execute arbitrary code as a privileged user. (CVE-2015-1061)
 - There is a flaw in iCloud Keychain which would allow a man-in-the-middle attacker to execute arbitrary code. (CVE-2015-1065)
 - The Springboard component allows a physical attacker to bypass controls and access the home screen.  (CVE-2015-1064)
 - The MobileStorageMounter component allows attackers to create arbitrary filesystem locations. (CVE-2015-1062)
 - The CoreTelephony component allows remote attackers to cause a denial of service. (CVE-2015-1063)
 - The Secure Transport component allows remote attackers to downgrade the encryption cipher. (CVE-2015-1067)

The version of Mac OS X is 10.10.x prior to version 10.10.3, and is affected by the following vulnerabilities :

 - There is an off-by-one error in the IOAcceleratorFamily component which would allow an attacker to execute arbitrary code. (CVE-2015-1066)
 - There is a flaw in the way that the IOSurface component handles "type confusion" which would allow a remote attacker to execute arbitrary code as a privileged user. (CVE-2015-1061)
 - There is a flaw in iCloud Keychain which would allow a man-in-the-middle attacker to execute arbitrary code. (CVE-2015-1065)
 - The Secure Transport component allows remote attackers to downgrade the encryption cipher. (CVE-2015-1067) 
 - The IOHIDFamily allows attackers within physical proximity to execute a Denial of Service attack within a kernel context. (CVE-2015-1095)
 - The CFNetwork component does not properly handle cookies which may allow an attacker to bypass Same Origin Policy. (CVE-2015-1089)
 - The 'fontd' daemon may allow remote code execution. (CVE-2015-1135)
 - A NULL pointer dereference flaw in 'Secure Transport' is triggered during the handling of a maliciously crafted X.509 certificate. This may allow a remote attacker to terminate arbitrary applications. (CVE-2015-1160)

The remote host is running a version of Mac OS X 10.10.2 that is missing Security Update 2015-003. It is, therefore, affected by the following vulnerabilities :

  - A type confusion flaw exists in how IOSurface handles     serialized objects, which an attacker can use to execute     arbitrary code with system privileges. (CVE-2015-1061)

  - Multiple buffer overflows exist due to iCloud Keychain     improperly validating user-supplied input. A remote,     man-in-the-middle attacker can exploit this, via     altering the client-server data stream during keychain     recovery, to cause a denial of service condition or to     execute arbitrary code. (CVE-2015-1065)

According to its banner, the remote Apple TV device is a version prior to 7.1. It is, therefore, affected by the following vulnerabilities :

  - A type confusion error exists related to 'IOSurface' and     serialized object handling that allow arbitrary code     execution. (CVE-2015-1061)

  - An error exists in 'MobileStorageMounter' related to     developer disk mounting logic and invalid disk image     folders that allows a malicious application to create     folders in trusted locations. (CVE-2015-1062)

  - A security feature bypass vulnerability, known as FREAK     (Factoring attack on RSA-EXPORT Keys), exists due to the     support of weak EXPORT_RSA cipher suites with keys less     than or equal to 512 bits. A man-in-the-middle attacker     may be able to downgrade the SSL/TLS connection to use     EXPORT_RSA cipher suites which can be factored in a     short amount of time, allowing the attacker to intercept     and decrypt the traffic. (CVE-2015-1067)

The mobile device is running a version of iOS prior to version 8.2.
It is, therefore, affected by vulnerabilities in the following components :

  - CoreTelephony
  - iCloud Keychain
  - IOSurface
  - MobileStorageMounter
  - Secure Transport
  - Springboard

The remote host is running a version of Mac OS X 10.8, 10.9, or 10.10 that does not have Security Update 2015-002 applied. This update contains several security-related fixes for the following components :

  - iCloud Keychain
  - IOAcceleratorFamily
  - IOSurface
  - mach_port_kobject kernel interface
  - Secure Transport

Note that successful exploitation of the most serious of these issues can result in arbitrary code execution.

ID	Name	Product	Family	Severity
8674	Apple TV < 7.0.4 Multiple Vulnerabilities	Nessus Network Monitor	Internet Services	high
8673	Apple iOS < 8.1.4 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
8672	Mac OS X < 10.10.3 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
81977	Mac OS X Multiple Vulnerabilities (Security Update 2015-003)	Nessus	MacOS X Local Security Checks	high
81790	Apple TV < 7.1 Multiple Vulnerabilities (FREAK)	Nessus	Misc.	critical
81746	Apple iOS < 8.2 Multiple Vulnerabilities	Nessus	Mobile Devices	high
81730	Mac OS X Multiple Vulnerabilities (Security Update 2015-002)	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2015-1061

high

Tenable Plugins

high

high

critical

high

critical

high

critical