Mac OS X Multiple Vulnerabilities (Security Update 2013-001)

high Nessus Plugin ID 65578


The remote host is missing a Mac OS X update that fixes several security issues.


The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-001 applied. This update contains numerous security-related fixes for the following components :

- Apache
- CoreTypes (10.7 only)
- International Components for Unicode
- Identity Services (10.7 only)
- ImageIO
- Messages Server (Server only)
- PDFKit
- Podcast Producer Server (Server only)
- PostgreSQL (Server only)
- Profile Manager (10.7 Server only)
- QuickTime
- Ruby (10.6 Server only)
- Security
- Software Update
- Wiki Server (10.7 Server only)

Note that the update also runs a malware removal tool that will remove the most common variants of malware.


Install Security Update 2013-001 or later.

See Also

Plugin Details

Severity: High

ID: 65578

File Name: macosx_SecUpd2013-001.nasl

Version: 1.18

Type: local

Agent: macosx

Published: 3/15/2013

Updated: 7/14/2018

Supported Sensors: Nessus Agent

Risk Information


Risk Factor: High

Score: 7.4


Risk Factor: High

Base Score: 9.3

Temporal Score: 7.7

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: E:F/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/o:apple:mac_os_x

Required KB Items: Host/local_checks_enabled, Host/MacOSX/Version, Host/MacOSX/packages/boms

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/14/2013

Vulnerability Publication Date: 3/28/2012

Exploitable With

Metasploit (Ruby on Rails JSON Processor YAML Deserialization Code Execution)

Reference Information

CVE: CVE-2011-3058, CVE-2012-2088, CVE-2012-3488, CVE-2012-3489, CVE-2012-3525, CVE-2012-3756, CVE-2013-0156, CVE-2013-0333, CVE-2013-0963, CVE-2013-0966, CVE-2013-0967, CVE-2013-0971, CVE-2013-0973

BID: 52762, 54270, 55072, 55074, 55167, 56552, 57187, 57575, 57598, 58509, 58513, 58514, 58516

APPLE-SA: APPLE-SA-2013-03-14-1