Mac OS X < 10.9.3 Multiple Vulnerabilities (Security Update 2014-002)

Critical Nessus Network Monitor Plugin ID 8265

Synopsis

The remote host is missing a Mac OS X update that fixes multiple security issues.

Description

The remote host is running a version of Mac OS X that is older than 10.9.3, and is thus missing security-related fixes for the following components:

 - CFNetwork HTTPProtocol
 - CoreServicesUIAgent
 - FontParser
 - Heimdal Kerberos
 - ImageIO
 - Intel Graphics Driver
 - IOKit Kernel
 - Kernel
 - Power Management
 - Ruby
 - Security
 - Secure Transport
 - Window Server

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

Solution

Upgrade to OS X 10.9.3 or higher.

See Also

http://seclists.org/bugtraq/2014/Apr/133

http://www.zerodayinitiative.com/advisories/ZDI-14-120

http://support.apple.com/kb/HT6207

http://support.apple.com/kb/HT6246

Plugin Details

Severity: Critical

ID: 8265

Family: Web Clients

Published: 2014/05/27

Updated: 2019/03/06

Dependencies: 1735, 8314

Nessus ID: 73648

Risk Information

Risk Factor: Critical

CVSS v2.0

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

CVSS v3.0

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:apple:mac_os_x

Patch Publication Date: 2014/04/22

Vulnerability Publication Date: 2014/04/22

Reference Information

CVE: CVE-2013-4164, CVE-2013-5170, CVE-2013-6393, CVE-2014-1295, CVE-2014-1296, CVE-2014-1314, CVE-2014-1315, CVE-2014-1316, CVE-2014-1318, CVE-2014-1319, CVE-2014-1320, CVE-2014-1321, CVE-2014-1322

BID: 63330, 63873, 65258, 67021, 67022, 67023, 67024, 67025, 67026, 67027, 67028, 67029, 67030