Mac OS X Multiple Vulnerabilities (Security Update 2010-002)

critical Nessus Plugin ID 45373

Language:

New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote host is missing a Mac OS X update that fixes various security issues.

Description

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-002 applied.

This security update contains fixes for the following products :

 - AppKit
 - Application Firewall
 - AFP Server
 - Apache
 - ClamAV
 - CoreTypes
 - CUPS
 - curl
 - Cyrus IMAP
 - Cyrus SASL
 - Disk Images
 - Directory Services
 - Event Monitor
 - FreeRADIUS
 - FTP Server
 - iChat Server
 - Image RAW
 - Libsystem
 - Mail
 - Mailman
 - OS Services
 - Password Server
 - perl
 - PHP
 - PS Normalizer
 - Ruby
 - Server Admin
 - SMB
 - Tomcat
 - unzip
 - vim
 - Wiki Server
 - X11
 - xar

Solution

Install Security Update 2010-002 or later.

See Also

http://support.apple.com/kb/HT4077

http://lists.apple.com/archives/security-announce/2010/Mar/msg00001.html

http://www.securityfocus.com/advisories/19364

Plugin Details

Severity: Critical

ID: 45373

File Name: macosx_SecUpd2010-002.nasl

Version: 1.29

Type: local

Agent: macosx

Published: 3/29/2010

Updated: 7/16/2018

Dependencies: ssh_get_info.nasl

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: E:H/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/o:apple:mac_os_x

Required KB Items: Host/MacOSX/packages, Host/uname

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/29/2010

Vulnerability Publication Date: 3/29/2010

Exploitable With

CANVAS (D2ExploitPack)

Core Impact

Reference Information

CVE: CVE-2003-0063, CVE-2006-1329, CVE-2008-0564, CVE-2008-0888, CVE-2008-2712, CVE-2008-4101, CVE-2008-5302, CVE-2008-5303, CVE-2008-5515, CVE-2009-0033, CVE-2009-0037, CVE-2009-0316, CVE-2009-0580, CVE-2009-0688, CVE-2009-0689, CVE-2009-0781, CVE-2009-0783, CVE-2009-1904, CVE-2009-2042, CVE-2009-2417, CVE-2009-2422, CVE-2009-2632, CVE-2009-2693, CVE-2009-2801, CVE-2009-2901, CVE-2009-2902, CVE-2009-2906, CVE-2009-3009, CVE-2009-3095, CVE-2009-3557, CVE-2009-3558, CVE-2009-3559, CVE-2009-4142, CVE-2009-4143, CVE-2009-4214, CVE-2010-0041, CVE-2010-0042, CVE-2010-0055, CVE-2010-0056, CVE-2010-0057, CVE-2010-0058, CVE-2010-0063, CVE-2010-0065, CVE-2010-0393, CVE-2010-0497, CVE-2010-0498, CVE-2010-0500, CVE-2010-0501, CVE-2010-0502, CVE-2010-0503, CVE-2010-0504, CVE-2010-0505, CVE-2010-0506, CVE-2010-0507, CVE-2010-0508, CVE-2010-0509, CVE-2010-0510, CVE-2010-0513, CVE-2010-0521, CVE-2010-0522, CVE-2010-0523, CVE-2010-0524, CVE-2010-0525, CVE-2010-0533

BID: 6940, 12767, 17155, 27630, 28288, 29715, 30795, 33447, 33962, 34961, 35193, 35196, 35233, 35263, 35278, 35416, 35510, 35579, 36032, 36278, 36296, 36377, 36554, 36555, 36573, 37142, 37389, 37390, 37942, 37944, 37945, 38524, 38676, 38677, 39151, 39156, 39157, 39169, 39170, 39171, 39172, 39175, 39194, 39231, 39232, 39234, 39245, 39252, 39255, 39256, 39264, 39268, 39273, 39274, 39277, 39279, 39281, 39289, 39290, 39292

CWE: 20, 22, 79, 119, 189, 200, 264, 287, 310, 352, 362