IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute arbitrary code in a privileged context via an application that provides crafted values in unspecified metadata fields, a different vulnerability than CVE-2014-4418.

The remote host is running a version of Mac OS X is prior to version 10.10. This update contains several security-related fixes for the following components :

  - 802.1X
  - AFP File Server
  - apache
  - App Sandbox
  - Bash
  - Bluetooth
  - Certificate Trust Policy
  - CFPreferences
  - CoreStorage
  - CUPS
  - Dock
  - fdesetup
  - iCloud Find My Mac
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - Kernel
  - LaunchServices
  - LoginWindow
  - Mail
  - MCX Desktop Config Profiles
  - NetFS Client Framework
  - QuickTime
  - Safari
  - Secure Transport
  - Security
  - Security - Code Signing

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

According to its banner, the remote Apple TV device is a version prior to 7. It is, therefore, affected by multiple vulnerabilities, the most serious of which can result in arbitrary code execution.

The remote host is running a version of Mac OS X that is older than 10.9.5, and is thus missing security-related fixes for the following components:

  - Bluetooth
  - CoreGraphics
  - Foundation
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - Intel Graphics Driver
  - Kernel
  - Libnotify
  - OpenSSL
  - QT Media Foundation
  - apache_mod_php
  - ruby

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The following components contain vulnerabilities that have since been patched in version 7.0:

  - 802.1X
  - Accounts
  - Accessibility
  - Accounts Framework
  - Address Book
  - App Installation
  - Assets
  - Bluetooth
  - CoreGraphics
  - Foundation
  - Home & Lock Screen
  - iMessage
  - IOAcceleratorFamily
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOHIDFamily
  - IOKit
  - Kernel
  - Libnotify
  - Mail
  - Profiles
  - Safari
  - Sandbox Profiles
  - syslog
  - WebKit

The remote host is running a version of Mac OS X 10.7 or 10.8 that does not have Security Update 2014-004 applied. This update contains several security-related fixes for the following components :

  - CoreGraphics
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - Libnotify
  - OpenSSL
  - QT Media Foundation

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.9.x that is prior to version 10.9.5. This update contains several security-related fixes for the following components :

  - apache_mod_php
  - Bluetooth
  - CoreGraphics
  - Foundation
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - Kernel
  - Libnotify
  - OpenSSL
  - QT Media Foundation
  - ruby

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The mobile device is running a version of iOS prior to version 8. It is, therefore, affected by vulnerabilities in the following components :

  - 802.1X
  - Accessibility
  - Accounts
  - Accounts Framework
  - Address Book
  - App Installation
  - Assets
  - Bluetooth
  - Certificate Trust Policy
  - CoreGraphics
  - Data Detectors
  - Foundation
  - Home and Lock Screen
  - iMessage
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - Kernel
  - Libnotify
  - Lockdown
  - Lockdown
  - Mail
  - Profiles
  - Safari
  - Sandbox Profiles
  - Settings
  - syslog
  - Weather
  - WebKit
  - Wifi

According to its banner, the remote iOS device is missing a security update.  Versions of Apple iOS prior to 8.0 are affected by vulnerabilities within the following components :

  - 802.1X
  - Accessibility
  - Accounts Framework
  - Accounts
  - Address Book
  - App Installation
  - Assets
  - Bluetooth
  - Certificate Trust Policy
  - CoreGraphics
  - Data Detectors
  - Foundation
  - Home & Lock Screen
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - Kernel
  - Libnotify
  - Lockdown
  - Mail
  - Profiles
  - Safari
  - Sandbox Profiles
  - Settings
  - Weather
  - WebKit
  - WiFi
  - iMessage
  - syslog

ID	Name	Product	Family	Severity
78550	Mac OS X < 10.10 Multiple Vulnerabilities (POODLE) (Shellshock)	Nessus	MacOS X Local Security Checks	critical
77822	Apple TV < 7 Multiple Vulnerabilities	Nessus	Misc.	high
8394	Mac OS X < 10.9.5 Multiple Vulnerabilities (Security Update 2014-004)	Nessus Network Monitor	Web Clients	critical
8392	Apple TV < 7 Multiple Vulnerabilities	Nessus Network Monitor	Internet Services	critical
77749	Mac OS X Multiple Vulnerabilities (Security Update 2014-004)	Nessus	MacOS X Local Security Checks	critical
77748	Mac OS X 10.9.x < 10.9.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
77745	Apple iOS < 8 Multiple Vulnerabilities	Nessus	Mobile Devices	high
8393	Apple iOS < 8.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high

Detections

Analytics

CVE-2014-4388

high

Tenable Plugins

critical

high

critical

critical

critical

critical

high

high