The remote host is running a version of Mac OS X 10.8 or 10.9 that does not have Security Update 2014-005 applied. This update contains several security-related fixes for the following issues :

  - A command injection vulnerability in GNU Bash known as     Shellshock. The vulnerability is due to the processing     of trailing strings after function definitions in the     values of environment variables. This allows a remote     attacker to execute arbitrary code via environment     variable manipulation depending on the configuration of     the system. (CVE-2014-6271, CVE-2014-7169)

  - A man-in-the-middle (MitM) information disclosure     vulnerability known as POODLE. The vulnerability is due     to the way SSL 3.0 handles padding bytes when decrypting     messages encrypted using block ciphers in cipher block     chaining (CBC) mode. A MitM attacker can decrypt a     selected byte of a cipher text in as few as 256 tries if     they are able to force a victim application to     repeatedly send the same data over newly created SSL 3.0     connections. (CVE-2014-3566)

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Detections

Analytics

Mac OS X Multiple Vulnerabilities (Security Update 2014-005) (POODLE) (Shellshock)

critical Nessus Plugin ID 78551

Version 1.28

Version 1.27

Version 1.26

Version 1.28 May 28, 2024, 2:57 PM Plugin metadata (Add version information to CPEs) Plugin Feed: 202405281457
Version 1.27 Apr 25, 2023, 11:11 PM CVSS temporal metrics (Adjust exploitability metrics for CISA KEV vulnerabilities) Plugin Feed: 202304252311
Version 1.26 Dec 6, 2022, 4:40 AM Reference Plugin Feed: 202212060440