The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-004 applied.  This update contains several security-related fixes for the following component :

  - Apache
  - Bind
  - Certificate Trust Policy
  - ClamAV
  - Installer
  - IPSec
  - Mobile Device Management
  - OpenSSL
  - PHP
  - PostgreSQL
  - QuickTime
  - sudo

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The version of QuickTime installed on the remote Windows host is earlier than 7.7.5.  It is, therefore, reportedly affected by the following vulnerabilities :

  - Out-of-bounds byte swapping issues exist in the     handling of QuickTime image descriptions and 'ttfo'     elements. (CVE-2013-1032, CVE-2014-1250)

  - An uninitialized pointer issue exists in the handling of     track lists.  (CVE-2014-1243)

  - Buffer overflow vulnerabilities exist in the handling of     H.264 encoded movie files, 'ftab' atoms, 'ldat' atoms,     PSD images, and 'clef' atoms. (CVE-2014-1244,     CVE-2014-1248, CVE-2014-1249, CVE-2014-1251)

  - A signedness issue exists in the handling of 'stsz'     atoms. (CVE-2014-1245)

  - A memory corruption issue exists in the handling of     'dref' atoms. (CVE-2014-1247)

Successful exploitation of these issues could result in program termination or arbitrary code execution, subject to the user's privileges.

The remote host is running a version of Mac OS X 10.8.x that is prior to 10.8.5. The newer version contains multiple security-related fixes for the following components :

  - Apache
  - Bind
  - Certificate Trust Policy
  - CoreGraphics
  - ImageIO
  - Installer
  - IPSec
  - Kernel
  - Mobile Device Management
  - OpenSSL
  - PHP
  - PostgreSQL
  - Power Management
  - QuickTime
  - Screen Lock
  - sudo

This update also addresses an issue in which certain Unicode strings could cause applications to unexpectedly quit.

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

Versions older than Quicktime 7.7.5 contain the following vulnerabilities:

  - An uninitialized pointer issue when handling track lists, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1243)

  - Multiple buffer overflow vulnerabilities, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1244, 2014-1246, CVE-2014-1248, CVE-2014-1249, CVE-2014-1251)

  - Multiple out-of-bounds byte swapping issues, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1250, CVE-2013-1032)

  - A signedness issue in the handling of 'stsz' atoms, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1245)

  - A memory corruption issue when handling the 'dref' atoms, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1247)

The remote host is missing Mac OS X security update 2013-004 that fixes multiple security issues. 

The remote host is running a version of Mac OS X 10.8 that is older than 10.8.5. The newer version contains numerous security-related fixes for the following components :

  - Apache
  - Bind
  - Certificate Trust Policy
  - CoreGraphics
  - ImageIO
  - Installer
  - IPSec
  - Kernel
  - Mobile Device Management
  - OpenSSL
  - PHP
  - PostgreSQL
  - Power Management
  - QuickTime
  - Screen Lock
  - sudo

 This update also addresses an issue in which certain Unicode strings could cause applications to unexpectedly quit.

 Note that successful exploitation of the most serious issues could result in arbitrary code execution.

ID	Name	Product	Family	Published	Updated	Severity
69878	Mac OS X Multiple Vulnerabilities (Security Update 2013-004)	Nessus	MacOS X Local Security Checks	9/13/2013	12/5/2022	critical
72706	QuickTime < 7.7.5 Multiple Vulnerabilities (Windows)	Nessus	Windows	2/26/2014	11/15/2018	high
69877	Mac OS X 10.8.x < 10.8.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	9/13/2013	12/5/2022	critical
8139	Quicktime (for Windows) < 7.7.5 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	2/26/2014	3/6/2019	medium
8008	Mac OS X 10.8 < 10.8.5 Multiple Vulnerabilities (Security Update 2013-004)	Nessus Network Monitor	Web Clients	9/16/2013	3/6/2019	critical

Detections

Analytics

Plugins Search

critical

high

critical

medium

critical