Multiple buffer overflows in iCloud Keychain in Apple iOS before 8.2 and Apple OS X through 10.10.2 allow man-in-the-middle attackers to execute arbitrary code by modifying the client-server data stream during keychain recovery.

According to its banner, the remote Apple iOS device is missing a security update.  It is, therefore, affected by the following vulnerabilities :

 - There is a flaw in the way that the IOSurface component handles "type confusion" which would allow a remote attacker to execute arbitrary code as a privileged user. (CVE-2015-1061)
 - There is a flaw in iCloud Keychain which would allow a man-in-the-middle attacker to execute arbitrary code. (CVE-2015-1065)
 - The Springboard component allows a physical attacker to bypass controls and access the home screen.  (CVE-2015-1064)
 - The MobileStorageMounter component allows attackers to create arbitrary filesystem locations. (CVE-2015-1062)
 - The CoreTelephony component allows remote attackers to cause a denial of service. (CVE-2015-1063)
 - The Secure Transport component allows remote attackers to downgrade the encryption cipher. (CVE-2015-1067)

The version of Mac OS X is 10.10.x prior to version 10.10.3, and is affected by the following vulnerabilities :

 - There is an off-by-one error in the IOAcceleratorFamily component which would allow an attacker to execute arbitrary code. (CVE-2015-1066)
 - There is a flaw in the way that the IOSurface component handles "type confusion" which would allow a remote attacker to execute arbitrary code as a privileged user. (CVE-2015-1061)
 - There is a flaw in iCloud Keychain which would allow a man-in-the-middle attacker to execute arbitrary code. (CVE-2015-1065)
 - The Secure Transport component allows remote attackers to downgrade the encryption cipher. (CVE-2015-1067) 
 - The IOHIDFamily allows attackers within physical proximity to execute a Denial of Service attack within a kernel context. (CVE-2015-1095)
 - The CFNetwork component does not properly handle cookies which may allow an attacker to bypass Same Origin Policy. (CVE-2015-1089)
 - The 'fontd' daemon may allow remote code execution. (CVE-2015-1135)
 - A NULL pointer dereference flaw in 'Secure Transport' is triggered during the handling of a maliciously crafted X.509 certificate. This may allow a remote attacker to terminate arbitrary applications. (CVE-2015-1160)

The remote host is running a version of Mac OS X 10.10.2 that is missing Security Update 2015-003. It is, therefore, affected by the following vulnerabilities :

  - A type confusion flaw exists in how IOSurface handles     serialized objects, which an attacker can use to execute     arbitrary code with system privileges. (CVE-2015-1061)

  - Multiple buffer overflows exist due to iCloud Keychain     improperly validating user-supplied input. A remote,     man-in-the-middle attacker can exploit this, via     altering the client-server data stream during keychain     recovery, to cause a denial of service condition or to     execute arbitrary code. (CVE-2015-1065)

The mobile device is running a version of iOS prior to version 8.2.
It is, therefore, affected by vulnerabilities in the following components :

  - CoreTelephony
  - iCloud Keychain
  - IOSurface
  - MobileStorageMounter
  - Secure Transport
  - Springboard

The remote host is running a version of Mac OS X 10.8, 10.9, or 10.10 that does not have Security Update 2015-002 applied. This update contains several security-related fixes for the following components :

  - iCloud Keychain
  - IOAcceleratorFamily
  - IOSurface
  - mach_port_kobject kernel interface
  - Secure Transport

Note that successful exploitation of the most serious of these issues can result in arbitrary code execution.

ID	Name	Product	Family	Severity
8673	Apple iOS < 8.1.4 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
8672	Mac OS X < 10.10.3 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
81977	Mac OS X Multiple Vulnerabilities (Security Update 2015-003)	Nessus	MacOS X Local Security Checks	high
81746	Apple iOS < 8.2 Multiple Vulnerabilities	Nessus	Mobile Devices	high
81730	Mac OS X Multiple Vulnerabilities (Security Update 2015-002)	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2015-1065

high

Tenable Plugins

high

critical

high

high

critical