CFPreferences in Apple OS X before 10.10 does not properly enforce the "require password after sleep or screen saver begins" setting, which makes it easier for physically proximate attackers to obtain access by leveraging an unattended workstation.

Apple OS X 10.10 (Yosemite) contains fixes for the following components: 
  - 802.1X
  - AFP File Server
  - App Sandbox
  - Bash
  - Bluetooth
  - CFPreferences
  - CUPS
  - Certificate Trust Policy
  - CoreStorage
  - Dock
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - Kernel
  - LaunchServices
  - LoginWindow
  - MCX Desktop Config Profiles
  - Mail
  - NetFS Client Framework
  - QuickTime
  - Safari
  - Secure Transport
  - Code Signing
  - Security
  - apache
  - fdesetup
  - iCloud Find My Mac

The remote host is running a version of Mac OS X is prior to version 10.10. This update contains several security-related fixes for the following components :

  - 802.1X
  - AFP File Server
  - apache
  - App Sandbox
  - Bash
  - Bluetooth
  - Certificate Trust Policy
  - CFPreferences
  - CoreStorage
  - CUPS
  - Dock
  - fdesetup
  - iCloud Find My Mac
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - Kernel
  - LaunchServices
  - LoginWindow
  - Mail
  - MCX Desktop Config Profiles
  - NetFS Client Framework
  - QuickTime
  - Safari
  - Secure Transport
  - Security
  - Security - Code Signing

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	Name	Product	Family	Severity
8555	Mac OS X < 10.10 Multiple Vulnerabilities (APPLE-SA-2014-10-16-1 OS X Yosemite v10.10)	Nessus Network Monitor	Web Clients	critical
78550	Mac OS X < 10.10 Multiple Vulnerabilities (POODLE) (Shellshock)	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2014-4425

medium

Tenable Plugins

critical

critical