The Security - Keychain component in Apple OS X before 10.9.4 does not properly implement keystroke observers, which allows physically proximate attackers to bypass the screen-lock protection mechanism, and enter characters into an arbitrary window under the lock window, via keyboard input.

The remote host is running a version of Mac OS X that is older than 10.9.4, and is thus missing security-related fixes for the following components:

  - Certificate Trust Policy
  - copyfile
  - curl
  - Dock
  - Graphics Driver
  - iBooks Commerce
  - Intel Graphics Driver
  - Intel Compute
  - IOAcceleratorFamily
  - IOReporting
  - Keychain
  - launchd
  - Secure Transport
  - Thunderbolt

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.9.x that is prior to 10.9.4. This update contains several security-related fixes for the following components :

  - Certificate Trust Policy
  - copyfile
  - curl
  - Dock
  - Graphics Driver
  - iBooks Commerce
  - Intel Graphics Driver
  - Intel Compute
  - IOAcceleratorFamily
  - IOReporting
  - Keychain
  - launchd
  - Secure Transport
  - Thunderbolt

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

ID	Name	Product	Family	Severity
8321	Mac OS X < 10.9.4 Multiple Vulnerabilities (Security Update 2014-003)	Nessus Network Monitor	Web Clients	critical
76317	Mac OS X 10.9.x < 10.9.4 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2014-1380

medium

Tenable Plugins

critical

critical