The mobile device is running a version of iOS that is prior to version 7.1.1. It is, therefore, affected by vulnerabilities in the following components :

  - CFNetwork HTTPProtocol
  - IOKit Kernel
  - Secure Transport
  - WebKit

The remote host is running a version of Mac OS X 10.7, 10.8, or 10.9 that does not have Security Update 2014-002 applied. This update contains several security-related fixes for the following components :

  - CFNetwork HTTPProtocl
  - CoreServicesUIAgent
  - FontParser
  - Heimdal Kerberos
  - ImageIO
  - Intel Graphics Driver
  - IOKit Kernel
  - Kernel
  - Power Management
  - Ruby
  - Security - Secure Transport
  - Window Server

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The remote host is running a version of Mac OS X that is older than 10.9.3, and is thus missing security-related fixes for the following components:

  - CFNetwork HTTPProtocol
  - CoreServicesUIAgent
  - FontParser
  - Heimdal Kerberos
  - ImageIO
  - Intel Graphics Driver
  - IOKit Kernel
  - Kernel
  - Power Management
  - Ruby
  - Security
  - Secure Transport
  - Window Server

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The following have since been patched in version 6.1.1:

  - Set-Cookie HTTP headers are processed even if the connection closed before the header was complete. An attacker could leverage this to strip security settings and obtain the HTTP cookie. (CVE-2014-1296)
  - Information disclosure due to the IOKit object storing kernel pointers, which could be used by a local attacker to defeat kernel address space layout randomization. (CVE-2014-1320)
  - A 'triple handshake' vulnerability could be leveraged by an attacker on the local network to perform a man-in-the-middle attack. (CVE-2014-1295)
  - Multiple memory corruption issues in the underlying WebKit library. (CVE-2013-2871, CVE-2014-1298, CVE-2014-1299, CVE-2014-1300, CVE-2014-1302, CVE-2014-1303, CVE-2014-1304, CVE-2014-1305, CVE-2014-1307, CVE-2014-1308, CVE-2014-1309, CVE-2014-1310, CVE-2014-1311, CVE-2014-1312, CVE-2014-1313, CVE-2014-1713)

According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS 7.x prior to 7.1.1 are exposed to the following vulnerabilities :

  - Information disclosure of user cookies in CFNetwork HTTPProtocol

  - Information disclosure of kernel pointers in IOKit Kernel

  - Potential man-in-the-middle attack via Secure Transport

  - Memory corruptions in Webkit

ID	Name	Product	Family	Published	Updated	Severity
73647	Apple iOS < 7.1.1 Multiple Vulnerabilities	Nessus	Mobile Devices	3/22/2014	9/4/2024	critical
73648	Mac OS X Multiple Vulnerabilities (Security Update 2014-002)	Nessus	MacOS X Local Security Checks	4/22/2014	5/28/2024	critical
8265	Mac OS X < 10.9.3 Multiple Vulnerabilities (Security Update 2014-002)	Nessus Network Monitor	Web Clients	5/27/2014	3/6/2019	critical
8274	Apple TV < 6.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Internet Services	5/29/2014	3/6/2019	medium
8275	Apple iOS 7.x < 7.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	5/29/2014	3/6/2019	medium

Detections

Analytics

Plugins Search

critical

critical

critical

medium

medium