macOS < 10.12 Multiple Vulnerabilities

critical Nessus Plugin ID 93685

Language:

Synopsis

The remote host is missing a macOS update that fixes multiple security vulnerabilities.

Description

The remote host is running a version of Mac OS X that is prior to 10.10.5, 10.11.x prior to 10.11.6, or is not macOS 10.12. It is, therefore, affected by multiple vulnerabilities in the following components :

- apache
- apache_mod_php
- Apple HSSPI Support
- AppleEFIRuntime
- AppleMobileFileIntegrity
- AppleUCC
- Application Firewall
- ATS
- Audio
- Bluetooth
- cd9660
- CFNetwork
- CommonCrypto
- CoreCrypto
- CoreDisplay
- curl
- Date & Time Pref Pane
- DiskArbitration
- File Bookmark
- FontParser
- IDS - Connectivity
- ImageIO
- Intel Graphics Driver
- IOAcceleratorFamily
- IOThunderboltFamily
- Kerberos v5 PAM module
- Kernel
- libarchive
- libxml2
- libxpc
- libxslt
- mDNSResponder
- NSSecureTextField
- Perl
- S2 Camera
- Security
- Terminal
- WindowServer

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Solution

Upgrade to macOS version 10.12 or later.

Plugin Details

Severity: Critical

ID: 93685

File Name: macos_10_12.nasl

Version: 1.12

Type: combined

Agent: macosx

Family: MacOS X Local Security Checks

Published: 9/23/2016

Updated: 6/19/2019

Supported Sensors: Nessus Agent

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2016-4658

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:apple:mac_os_x, cpe:/o:apple:macos

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/20/2016

Vulnerability Publication Date: 9/20/2016

Exploitable With

Elliot (IPS Community Suite RCE)

Reference Information

CVE: CVE-2016-0755, CVE-2016-4617, CVE-2016-4658, CVE-2016-4682, CVE-2016-4694, CVE-2016-4696, CVE-2016-4697, CVE-2016-4698, CVE-2016-4699, CVE-2016-4700, CVE-2016-4701, CVE-2016-4702, CVE-2016-4703, CVE-2016-4706, CVE-2016-4707, CVE-2016-4708, CVE-2016-4709, CVE-2016-4710, CVE-2016-4711, CVE-2016-4712, CVE-2016-4713, CVE-2016-4715, CVE-2016-4716, CVE-2016-4717, CVE-2016-4718, CVE-2016-4722, CVE-2016-4723, CVE-2016-4724, CVE-2016-4725, CVE-2016-4726, CVE-2016-4727, CVE-2016-4736, CVE-2016-4738, CVE-2016-4739, CVE-2016-4742, CVE-2016-4745, CVE-2016-4748, CVE-2016-4750, CVE-2016-4752, CVE-2016-4753, CVE-2016-4755, CVE-2016-4771, CVE-2016-4772, CVE-2016-4773, CVE-2016-4774, CVE-2016-4775, CVE-2016-4776, CVE-2016-4777, CVE-2016-4778, CVE-2016-4779, CVE-2016-5131, CVE-2016-5768, CVE-2016-5769, CVE-2016-5770, CVE-2016-5771, CVE-2016-5772, CVE-2016-5773, CVE-2016-6174, CVE-2016-6288, CVE-2016-6289, CVE-2016-6290, CVE-2016-6291, CVE-2016-6292, CVE-2016-6294, CVE-2016-6295, CVE-2016-6296, CVE-2016-6297, CVE-2016-7580, CVE-2016-7582

BID: 82307, 91396, 91397, 91398, 91399, 91401, 91403, 91732, 92053, 92073, 92074, 92078, 92094, 92095, 92097, 92099, 92111, 92115, 93054, 93055, 93056, 93059, 93060, 93063, 93852, 94434, 94435, 96329

APPLE-SA: APPLE-SA-2016-09-20

Detections

Analytics