Mac OS X Multiple Vulnerabilities (Security Update 2014-001) (BEAST)
critical Nessus Plugin ID 72688
Language:
Synopsis
The remote host is missing a Mac OS X update that fixes multiple security vulnerabilities.Description
The remote host is running a version of Mac OS X 10.7 or 10.8 that does not have Security Update 2014-001 applied. This update contains several security-related fixes for the following components :- Apache
- App Sandbox
- ATS
- Certificate Trust Policy
- CFNetwork Cookies
- CoreAnimation
- Date and Time
- File Bookmark
- ImageIO
- IOSerialFamily
- LaunchServices
- NVIDIA Drivers
- PHP
- QuickLook
- QuickTime
- Secure Transport
Note that successful exploitation of the most serious issues could result in arbitrary code execution.
Solution
Install Security Update 2014-001 or later.See Also
https://support.apple.com/en-us/HT202932
http://lists.apple.com/archives/security-announce/2014/Feb/msg00000.html
http://www.securityfocus.com/archive/1/531263/30/0/threaded
https://www.imperialviolet.org/2011/09/23/chromeandbeast.html
Plugin Details
Severity: Critical
ID: 72688
File Name: macosx_SecUpd2014-001.nasl
Version: 1.21
Type: local
Agent: macosx
Family: MacOS X Local Security Checks
Published: 2/25/2014
Updated: 7/14/2018
Supported Sensors: Nessus Agent
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.8
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal Vector: E:POC/RL:OF/RC:C
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: E:P/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:apple:mac_os_x
Required KB Items: Host/local_checks_enabled, Host/MacOSX/Version, Host/MacOSX/packages/boms
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 2/25/2014
Vulnerability Publication Date: 8/31/2011
Reference Information
CVE: CVE-2011-3389, CVE-2013-1862, CVE-2013-1896, CVE-2013-4073, CVE-2013-4113, CVE-2013-4248, CVE-2013-5139, CVE-2013-5178, CVE-2013-5179, CVE-2013-5986, CVE-2013-5987, CVE-2013-6420, CVE-2013-6629, CVE-2014-1245, CVE-2014-1246, CVE-2014-1247, CVE-2014-1248, CVE-2014-1249, CVE-2014-1250, CVE-2014-1252, CVE-2014-1254, CVE-2014-1256, CVE-2014-1257, CVE-2014-1258, CVE-2014-1259, CVE-2014-1260, CVE-2014-1265
BID: 49778, 59826, 60843, 61128, 61129, 62536, 63311, 63343, 63676, 64225, 64525, 65113, 65208, 65777