Detections
Analytics

Mac OS X Multiple Vulnerabilities (Security Update 2014-002)

critical Nessus Plugin ID 73648

Language:

Synopsis

The remote host is missing a Mac OS X update that fixes multiple security issues.

Description

The remote host is running a version of Mac OS X 10.7, 10.8, or 10.9 that does not have Security Update 2014-002 applied. This update contains several security-related fixes for the following components :

 - CFNetwork HTTPProtocl
 - CoreServicesUIAgent
 - FontParser
 - Heimdal Kerberos
 - ImageIO
 - Intel Graphics Driver
 - IOKit Kernel
 - Kernel
 - Power Management
 - Ruby
 - Security - Secure Transport
 - Window Server

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

Solution

Either install Security Update 2014-002 or upgrade to OS X Mavericks 10.9.3.

See Also

https://support.apple.com/en-us/HT202966

http://www.securityfocus.com/archive/1/531900/30/0/threaded

https://support.apple.com/en-us/HT202991

http://www.securityfocus.com/archive/1/532113/30/0/threaded

Plugin Details

Severity: Critical

ID: 73648

File Name: macosx_SecUpd2014-002.nasl

Version: 1.18

Type: local

Agent: macosx

Published: 4/22/2014

Updated: 5/28/2024

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2014-1314

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:apple:mac_os_x:10.9

Required KB Items: Host/local_checks_enabled, Host/MacOSX/Version, Host/MacOSX/packages/boms

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/22/2014

Vulnerability Publication Date: 10/23/2013

Reference Information

CVE: CVE-2013-4164, CVE-2013-5170, CVE-2013-6393, CVE-2014-1295, CVE-2014-1296, CVE-2014-1314, CVE-2014-1315, CVE-2014-1316, CVE-2014-1318, CVE-2014-1319, CVE-2014-1320, CVE-2014-1321, CVE-2014-1322, CVE-2014-2234

BID: 63330, 63873, 65258, 65989, 67021, 67022, 67023, 67024, 67025, 67026, 67027, 67028, 67029, 67030

APPLE-SA: APPLE-SA-2014-04-22-1