The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.3. It is, therefore, affected by multiple vulnerabilities related to the following components:

  - AppleKeyStore
  - Bluetooth
  - Core Media
  - CoreAnimation
  - FaceTime
  - IOKit
  - Kernel
  - libxpc
  - Natural Language Processing
  - QuartzCore
  - SQLite
  - WebRTC

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The version of Apple iOS running on the mobile device is prior to 12.1.3. It is, therefore, affected by multiple vulnerabilities:

  - Multiple unspecified vulnerabilities in WebKit     can lead to arbitrary code execution if a user     is enticed to visit a malicious web page.
    (CVE-2019-6227, CVE-2019-6233, CVE-2019-6234)

  - A maliciously crafted SQL query could lead to     arbitrary code execution.
    (CVE-2018-20346, CVE-2018-20505,     CVE-2018-20506)

  - A malicious application could lead to arbitrary     code execution with kernel privileges.
    (CVE-2019-6218)

Additionally several other vulnerabilities exist, the highest of which could allow an attacker to perform a remote code execution attack by enticing a user to view malicious web content.

The version of Apple iTunes installed on the remote Windows host is prior to 12.9.3. It is, therefore, affected by multiple vulnerabilities as referenced in the HT209450 advisory:

  - Multiple vulnerabilities exist due to input processing     flaws in the WebKit component. An attacker may be able     to leverage one of these vulnerability, by providing     maliciously crafted web content, to execute arbitrary     code on the host. (CVE-2019-6212, CVE-2019-6215,     CVE-2019-6216, CVE-2019-6217, CVE-2019-6226,     CVE-2019-6227, CVE-2019-6233, CVE-2019-6234)

  - A universal cross-site scripting vulnerability exists in     the WebKit component. An attacker may be able to leverage     this vulnerability, by providing maliciously crafted web     content, to execute arbitrary script code in the security     context of any site. (CVE-2019-6229)

  - A memory corruption vulnerability exists in the     AppleKeyStore component. An attacker may be able to     leverage this vulnerability to allow a process to     circumvent sandbox restrictions. (CVE-2019-6235)

  - An out-of-bounds read vulnerability exists in the     Core Media component. An attacker may be able to leverage     this vulnerability to allow a malicious application to     elevate its privileges. (CVE-2019-6221)

  - Multiple memory corruption issues exist in the SQLite     component. An attacker may be able to leverage these     vulnerabilities, by executing a malicious SQL query, to     execute arbitrary code on the host. (CVE-2018-20346,     CVE-2018-20505, CVE-2018-20506)


Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.3. It is, therefore, affected by multiple vulnerabilities related to the following components:

 - AppleKeyStore
 - Bluetooth
 - Core Media
 - CoreAnimation
 - FaceTime
 - IOKit
 - Kernel
 - libxpc
 - Natural Language Processing
 - QuartzCore
 - SQLite
 - WebRTC

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The version of Apple iOS running on the mobile device is prior to 12.1.3. It is, therefore, affected by multiple vulnerabilities:

 - Multiple unspecified vulnerabilities in WebKit can lead to arbitrary code execution if a user is enticed to visit a malicious web page. (CVE-2019-6227, CVE-2019-6233, CVE-2019-6234)

 - A maliciously crafted SQL query could lead to arbitrary code execution. (CVE-2018-20346, CVE-2018-20505, CVE-2018-20506)

 - A malicious application could lead to arbitrary code execution with kernel privileges. (CVE-2019-6218)

Additionally several other vulnerabilities exist, the highest of which could allow an attacker to perform a remote code execution attack by enticing a user to view malicious web content.

ID	Name	Product	Family	Published	Updated	Severity
121393	macOS 10.14.x < 10.14.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	1/25/2019	5/24/2022	critical
121331	Apple iOS < 12.1.3 Multiple Vulnerabilities	Nessus	Mobile Devices	1/23/2019	9/4/2024	critical
121473	Apple iTunes < 12.9.3 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	1/30/2019	10/31/2019	critical
700521	macOS 10.14.x < 10.14.3 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	4/10/2019	4/10/2019	critical
700556	Apple iOS < 12.1.3 Multiple Vulnerabilities (APPLE-SA-2019-1-22-1)	Nessus Network Monitor	Mobile Devices	4/17/2019	4/17/2019	medium

Detections

Analytics

Plugins Search

critical

critical

critical

critical

medium