Detections
Analytics

Mac OS X Multiple Vulnerabilities (Security Update 2012-002) (BEAST)

critical Nessus Plugin ID 59067

Language:

Synopsis

The remote host is missing a Mac OS X update that fixes multiple security vulnerabilities.

Description

The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2012-002 applied. This update contains multiple security-related fixes for the following components :

 - curl
 - Directory Service
 - ImageIO
 - libarchive
 - libsecurity
 - libxml
 - Quartz Composer
 - QuickTime
 - Ruby
 - Samba
 - Security Framework

Solution

Install Security Update 2012-002 or later.

See Also

http://www.zerodayinitiative.com/advisories/ZDI-12-137/

http://www.securityfocus.com/archive/1/523932/30/0/threaded

http://support.apple.com/kb/HT5281

http://lists.apple.com/archives/security-announce/2012/May/msg00001.html

https://www.imperialviolet.org/2011/09/23/chromeandbeast.html

https://www.openssl.org/~bodo/tls-cbc.txt

Plugin Details

Severity: Critical

ID: 59067

File Name: macosx_SecUpd2012-002.nasl

Version: 1.25

Type: local

Agent: macosx

Published: 5/10/2012

Updated: 5/28/2024

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/o:apple:mac_os_x:10.6

Required KB Items: Host/local_checks_enabled, Host/MacOSX/Version, Host/MacOSX/packages/boms

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/9/2012

Vulnerability Publication Date: 1/21/2011

Exploitable With

CANVAS (CANVAS)

Core Impact

Metasploit (Samba SetInformationPolicy AuditEventsInfo Heap Overflow)

Reference Information

CVE: CVE-2011-0241, CVE-2011-1004, CVE-2011-1005, CVE-2011-1167, CVE-2011-1777, CVE-2011-1778, CVE-2011-1944, CVE-2011-2692, CVE-2011-2821, CVE-2011-2834, CVE-2011-3328, CVE-2011-3389, CVE-2011-3919, CVE-2011-4815, CVE-2012-0651, CVE-2012-0654, CVE-2012-0655, CVE-2012-0657, CVE-2012-0658, CVE-2012-0659, CVE-2012-0660, CVE-2012-0662, CVE-2012-0870, CVE-2012-1182

BID: 46458, 46460, 46951, 47737, 48056, 48618, 48833, 49279, 49658, 49744, 49778, 51198, 51300, 52103, 52973, 53458, 53462, 53465, 53467, 53468, 53469, 53471, 53473

APPLE-SA: APPLE-SA-2012-05-09-1

CERT: 864643