Mac OS X 10.9.x < 10.9.2 Multiple Vulnerabilities
critical Nessus Plugin ID 72687
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote host is missing a Mac OS X update that fixes a certificate validation weakness.Description
The remote host is running a version of Mac OS X 10.9.x that is prior to 10.9.2. This update contains several security-related fixes for the following components :- Apache
- ATS
- Certificate Trust Policy
- CoreAnimation
- CoreText
- curl
- Data Security
- Date and Time
- File Bookmark
- Finder
- ImageIO
- NVIDIA Drivers
- PHP
- QuickLook
- QuickTime
Note that successful exploitation of the most serious issues could result in arbitrary code execution.
Solution
Upgrade to Mac OS X 10.9.2 or later.See Also
http://support.apple.com/kb/HT6150
http://lists.apple.com/archives/security-announce/2014/Feb/msg00000.html
Plugin Details
Severity: Critical
ID: 72687
File Name: macosx_10_9_2.nasl
Version: 1.18
Type: combined
Agent: macosx
Family: MacOS X Local Security Checks
Published: 2/25/2014
Updated: 7/14/2018
Dependencies: ssh_get_info.nasl, os_fingerprint.nasl
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.8
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal Vector: E:POC/RL:OF/RC:C
Vulnerability Information
CPE: cpe:/o:apple:mac_os_x
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 2/25/2014
Vulnerability Publication Date: 5/23/2012
Reference Information
CVE: CVE-2013-1862, CVE-2013-1896, CVE-2013-4073, CVE-2013-4113, CVE-2013-4248, CVE-2013-5986, CVE-2013-5987, CVE-2013-6420, CVE-2013-6629, CVE-2014-1245, CVE-2014-1246, CVE-2014-1247, CVE-2014-1248, CVE-2014-1249, CVE-2014-1250, CVE-2014-1252, CVE-2014-1254, CVE-2014-1255, CVE-2014-1256, CVE-2014-1258, CVE-2014-1259, CVE-2014-1261, CVE-2014-1262, CVE-2014-1263, CVE-2014-1264, CVE-2014-1265, CVE-2014-1266
BID: 59826, 60843, 61128, 61129, 61776, 63676, 64225, 64525, 65113, 65208, 65738, 65777