macOS 10.14.x < 10.14.4 Multiple Vulnerabilities

Critical Nessus Plugin ID 123128

Synopsis

The remote host is missing a macOS update that fixes multiple security vulnerabilities.

Description

The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.4. It is, therefore, affected by multiple vulnerabilities, including:

- Mounting a maliciously crafted NFS network share may lead to arbitrary code execution with system privileges. (CVE-2019-8508)

- An application may be able to execute arbitrary code with kernel privileges. (CVE-2019-8529)

- A malicious application may be able to execute arbitrary code with system privileges (CVE-2019-8549)

Solution

Upgrade to macOS version 10.14.4 or later.

See Also

https://support.apple.com/en-us/HT209600

http://www.nessus.org/u?71533e9d

Plugin Details

Severity: Critical

ID: 123128

File Name: macos_10_14_4.nasl

Version: 1.5

Type: combined

Agent: macosx

Published: 2019/03/27

Updated: 2019/05/21

Dependencies: 11936, 12634

Risk Information

Risk Factor: Critical

CVSS Score Source: CVE-2019-8508

CVSS v2.0

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSS v3.0

Base Score: 9.6

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:apple:mac_os_x, cpe:/o:apple:macos

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2019/03/25

Vulnerability Publication Date: 2019/03/25

Exploitable With

Metasploit (Mac OS X Feedback Assistant Race Condition)

Reference Information

CVE: CVE-2018-12015, CVE-2018-18311, CVE-2018-18313, CVE-2019-6207, CVE-2019-6237, CVE-2019-6239, CVE-2019-7293, CVE-2019-8502, CVE-2019-8504, CVE-2019-8507, CVE-2019-8508, CVE-2019-8510, CVE-2019-8511, CVE-2019-8513, CVE-2019-8514, CVE-2019-8516, CVE-2019-8517, CVE-2019-8519, CVE-2019-8520, CVE-2019-8521, CVE-2019-8522, CVE-2019-8526, CVE-2019-8527, CVE-2019-8529, CVE-2019-8530, CVE-2019-8533, CVE-2019-8537, CVE-2019-8540, CVE-2019-8542, CVE-2019-8545, CVE-2019-8546, CVE-2019-8549, CVE-2019-8550, CVE-2019-8552, CVE-2019-8555, CVE-2019-8561, CVE-2019-8565

BID: 104423, 106072, 106145

APPLE-SA: APPLE-SA-2019-3-25-2