Mail in Apple Mac OS X before 10.7.5 does not properly handle embedded web plugins, which allows remote attackers to execute arbitrary plugin code via an e-mail message that triggers the loading of a third-party plugin.

The remote host is running a version of Mac OS X 10.7 that is older than version 10.7.5.  The newer version contains numerous security-related fixes for the following components :

  - Apache

  - BIND

  - CoreText

  - Data Security

  - ImageIO

  - Installer

  - International Components for Unicode

  - Kernel

  - Mail

  - PHP

  - Profile Manager

  - QuickLook

  - QuickTime

  - Ruby

  - USB

The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.5. The newer version contains multiple security-related fixes for the following components :

  - Apache
  - BIND
  - CoreText
  - Data Security
  - ImageIO
  - Installer
  - International Components for Unicode
  - Kernel
  - Mail
  - PHP
  - Profile Manager
  - QuickLook
  - QuickTime
  - Ruby
  - USB

The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2012-004 applied. This update contains multiple security-related fixes for the following components :

  - Apache
  - Data Security
  - DirectoryService
  - ImageIO
  - International Components for Unicode
  - Mail
  - PHP
  - QuickLook
  - QuickTime
  - Ruby

ID	Name	Product	Family	Severity
6583	Mac OS X 10.7 < 10.7.5 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
62214	Mac OS X 10.7.x < 10.7.5 Multiple Vulnerabilities (BEAST)	Nessus	MacOS X Local Security Checks	critical
62213	Mac OS X Multiple Vulnerabilities (Security Update 2012-004) (BEAST)	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2012-3719

critical

Tenable Plugins

critical

critical

critical