Mac OS X < 10.10.3 Multiple Vulnerabilities
critical Nessus Network Monitor Plugin ID 8672
Synopsis
The remote host is missing a critical Mac OS X patch update.Description
The version of Mac OS X is 10.10.x prior to version 10.10.3, and is affected by the following vulnerabilities :- There is an off-by-one error in the IOAcceleratorFamily component which would allow an attacker to execute arbitrary code. (CVE-2015-1066)
- There is a flaw in the way that the IOSurface component handles "type confusion" which would allow a remote attacker to execute arbitrary code as a privileged user. (CVE-2015-1061)
- There is a flaw in iCloud Keychain which would allow a man-in-the-middle attacker to execute arbitrary code. (CVE-2015-1065)
- The Secure Transport component allows remote attackers to downgrade the encryption cipher. (CVE-2015-1067)
- The IOHIDFamily allows attackers within physical proximity to execute a Denial of Service attack within a kernel context. (CVE-2015-1095)
- The CFNetwork component does not properly handle cookies which may allow an attacker to bypass Same Origin Policy. (CVE-2015-1089)
- The 'fontd' daemon may allow remote code execution. (CVE-2015-1135)
- A NULL pointer dereference flaw in 'Secure Transport' is triggered during the handling of a maliciously crafted X.509 certificate. This may allow a remote attacker to terminate arbitrary applications. (CVE-2015-1160)
Solution
Upgrade to Mac OS X 10.10.3 or later.See Also
https://support.apple.com/HT204413
http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html
Plugin Details
Severity: Critical
ID: 8672
Family: Operating System Detection
Published: 4/5/2015
Updated: 3/6/2019
Risk Information
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal Vector: CVSS2#E:ND/RL:OF/RC:C
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 9.4
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C
Vulnerability Information
CPE: cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Patch Publication Date: 3/12/2015
Vulnerability Publication Date: 3/12/2015
Reference Information
CVE: CVE-2015-1061, CVE-2015-1065, CVE-2015-1067, CVE-2015-1089, CVE-2015-1095, CVE-2015-1135, CVE-2015-1160, CVE-2015-1066