The version of Apple iTunes installed on the remote host is prior to version 11.2. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the CFNetwork HTTPProtocol due to a     failure to properly ensure that a Set-Cookie HTTP header     is complete before interpreting the header's value. A     man-in-the-middle attacker can exploit this to bypass     security settings by closing the connection before the     security settings are sent, resulting in the disclosure     of sensitive information. (CVE-2014-1296)

  - A memory corruption issue exists due to improper     validation of user-supplied input when handling MP4     files. An attacker can exploit this, by convincing a     user to open a specially crafted MP4 file, to corrupt     memory, resulting in the execution of arbitrary code.
    (CVE-2014-8842)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X 10.7, 10.8, or 10.9 that does not have Security Update 2014-002 applied. This update contains several security-related fixes for the following components :

  - CFNetwork HTTPProtocl
  - CoreServicesUIAgent
  - FontParser
  - Heimdal Kerberos
  - ImageIO
  - Intel Graphics Driver
  - IOKit Kernel
  - Kernel
  - Power Management
  - Ruby
  - Security - Secure Transport
  - Window Server

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The version of Apple iTunes running on the remote host is prior to version 11.2. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the CFNetwork HTTPProtocol due to a     failure to properly ensure that a Set-Cookie HTTP header     is complete before interpreting the header's value. A     man-in-the-middle attacker can exploit this to bypass     security settings by closing the connection before the     security settings are sent, resulting in the disclosure     of sensitive information. (CVE-2014-1296)

  - A memory corruption issue exists due to improper     validation of user-supplied input when handling MP4     files. An attacker can exploit this, by convincing a     user to open a specially crafted MP4 file, to corrupt     memory, resulting in the execution of arbitrary code.
    (CVE-2014-8842)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The mobile device is running a version of iOS that is prior to version 7.1.1. It is, therefore, affected by vulnerabilities in the following components :

  - CFNetwork HTTPProtocol
  - IOKit Kernel
  - Secure Transport
  - WebKit

The remote host is running a version of Mac OS X that is older than 10.9.3, and is thus missing security-related fixes for the following components:

  - CFNetwork HTTPProtocol
  - CoreServicesUIAgent
  - FontParser
  - Heimdal Kerberos
  - ImageIO
  - Intel Graphics Driver
  - IOKit Kernel
  - Kernel
  - Power Management
  - Ruby
  - Security
  - Secure Transport
  - Window Server

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The following have since been patched in version 6.1.1:

  - Set-Cookie HTTP headers are processed even if the connection closed before the header was complete. An attacker could leverage this to strip security settings and obtain the HTTP cookie. (CVE-2014-1296)
  - Information disclosure due to the IOKit object storing kernel pointers, which could be used by a local attacker to defeat kernel address space layout randomization. (CVE-2014-1320)
  - A 'triple handshake' vulnerability could be leveraged by an attacker on the local network to perform a man-in-the-middle attack. (CVE-2014-1295)
  - Multiple memory corruption issues in the underlying WebKit library. (CVE-2013-2871, CVE-2014-1298, CVE-2014-1299, CVE-2014-1300, CVE-2014-1302, CVE-2014-1303, CVE-2014-1304, CVE-2014-1305, CVE-2014-1307, CVE-2014-1308, CVE-2014-1309, CVE-2014-1310, CVE-2014-1311, CVE-2014-1312, CVE-2014-1313, CVE-2014-1713)

Versions of iTunes earlier than 11.2 are affected by multiple vulnerabilities :

 - A flaw exists in the way Set-Cookie HTTP headers are processed when the connection is closed before the header line was complete.  An attacker could strip security settings from the cookie by forcing the connection to close before the security settings were sent, and then obtain the value of the unprotected cookie. (CVE-2014-1296)
 - A memory corruption issue exists in iTunes MP4 parsing.  A maliciously crafted audio or movie file could be used to trigger an unexpected application termination or arbitrary code execution. (CVE-2014-8842)

According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS 7.x prior to 7.1.1 are exposed to the following vulnerabilities :

  - Information disclosure of user cookies in CFNetwork HTTPProtocol

  - Information disclosure of kernel pointers in IOKit Kernel

  - Potential man-in-the-middle attack via Secure Transport

  - Memory corruptions in Webkit

ID	Name	Product	Family	Published	Updated	Severity
74040	Apple iTunes < 11.2 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	5/16/2014	11/26/2019	medium
73648	Mac OS X Multiple Vulnerabilities (Security Update 2014-002)	Nessus	MacOS X Local Security Checks	4/22/2014	5/28/2024	critical
74041	Apple iTunes < 11.2 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	5/16/2014	11/26/2019	medium
73647	Apple iOS < 7.1.1 Multiple Vulnerabilities	Nessus	Mobile Devices	3/22/2014	9/4/2024	critical
8265	Mac OS X < 10.9.3 Multiple Vulnerabilities (Security Update 2014-002)	Nessus Network Monitor	Web Clients	5/27/2014	3/6/2019	critical
8274	Apple TV < 6.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Internet Services	5/29/2014	3/6/2019	medium
9397	iTunes for Windows < 11.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	7/19/2015	3/6/2019	high
8275	Apple iOS 7.x < 7.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	5/29/2014	3/6/2019	medium

Detections

Analytics

Plugins Search

medium

critical

medium

critical

critical

medium

high

medium