The remote host is running a version of Mac OS X 10.7 or 10.8 that does not have Security Update 2014-001 applied. This update contains several security-related fixes for the following components :

  - Apache
  - App Sandbox
  - ATS
  - Certificate Trust Policy
  - CFNetwork Cookies
  - CoreAnimation
  - Date and Time
  - File Bookmark
  - ImageIO
  - IOSerialFamily
  - LaunchServices
  - NVIDIA Drivers
  - PHP
  - QuickLook
  - QuickTime
  - Secure Transport

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The version of QuickTime installed on the remote Windows host is earlier than 7.7.5.  It is, therefore, reportedly affected by the following vulnerabilities :

  - Out-of-bounds byte swapping issues exist in the     handling of QuickTime image descriptions and 'ttfo'     elements. (CVE-2013-1032, CVE-2014-1250)

  - An uninitialized pointer issue exists in the handling of     track lists.  (CVE-2014-1243)

  - Buffer overflow vulnerabilities exist in the handling of     H.264 encoded movie files, 'ftab' atoms, 'ldat' atoms,     PSD images, and 'clef' atoms. (CVE-2014-1244,     CVE-2014-1248, CVE-2014-1249, CVE-2014-1251)

  - A signedness issue exists in the handling of 'stsz'     atoms. (CVE-2014-1245)

  - A memory corruption issue exists in the handling of     'dref' atoms. (CVE-2014-1247)

Successful exploitation of these issues could result in program termination or arbitrary code execution, subject to the user's privileges.

The remote host is running a version of Mac OS X 10.9.x that is prior to 10.9.2. This update contains several security-related fixes for the following components :

  - Apache
  - ATS
  - Certificate Trust Policy
  - CoreAnimation
  - CoreText
  - curl
  - Data Security
  - Date and Time
  - File Bookmark
  - Finder
  - ImageIO
  - NVIDIA Drivers
  - PHP
  - QuickLook
  - QuickTime

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The remote host is running a version of Mac OS X that is older than 10.9.2. The newer version contains numerous security-related fixes for the following components :

  - Apache

  - ATS

  - Certificate Trust Policy

  - CoreAnimation

  - CoreText

  - curl

  - Data Security

  - Date and Time

  - File Bookmark

  - Finder

  - ImageIO

  - NVIDIA Drivers

  - PHP

  - QuickLook

  - QuickTime

An attacker could leverage the most serious of these issues to execute arbitrary code.

Versions older than Quicktime 7.7.5 contain the following vulnerabilities:

  - Multiple buffer overflow vulnerabilities, which can be leveraged by an attacker to execute arbitrary code or application termination (2014-1246, CVE-2014-1248, CVE-2014-1249)

  - An out-of-bounds byte swapping issue in the handling of 'ttfo' elements, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1250)

  - A signedness issue in the handling of 'stsz' atoms, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1245)

  - A memory corruption issue when handling the 'dref' atoms, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1247)

Versions older than Quicktime 7.7.5 contain the following vulnerabilities:

  - An uninitialized pointer issue when handling track lists, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1243)

  - Multiple buffer overflow vulnerabilities, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1244, 2014-1246, CVE-2014-1248, CVE-2014-1249, CVE-2014-1251)

  - Multiple out-of-bounds byte swapping issues, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1250, CVE-2013-1032)

  - A signedness issue in the handling of 'stsz' atoms, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1245)

  - A memory corruption issue when handling the 'dref' atoms, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1247)

ID	Name	Product	Family	Published	Updated	Severity
72688	Mac OS X Multiple Vulnerabilities (Security Update 2014-001) (BEAST)	Nessus	MacOS X Local Security Checks	2/25/2014	5/28/2024	critical
72706	QuickTime < 7.7.5 Multiple Vulnerabilities (Windows)	Nessus	Windows	2/26/2014	11/15/2018	high
72687	Mac OS X 10.9.x < 10.9.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2/25/2014	5/28/2024	critical
8138	Mac OS X < 10.9.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2/26/2014	3/6/2019	critical
8140	Apple Quicktime 7.7.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2/26/2014	3/6/2019	medium
8139	Quicktime (for Windows) < 7.7.5 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	2/26/2014	3/6/2019	medium

Detections

Analytics

Plugins Search

critical

high

critical

critical

medium

medium