{"nessus": [{"lastseen": "2018-09-02T00:01:58", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=1295351", "http://www.nessus.org/u?b0a63992"], "pluginID": "89578", "description": "- update to nghttp2-1.6.0 (fixes CVE-2015-8659)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "edition": 5, "reporter": "Tenable", "published": "2016-03-04T00:00:00", "title": "Fedora 22 : nghttp2-1.6.0-1.fc22 (2016-8e13ac5754)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 2.1}}, "naslFamily": "Fedora Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-8659"], "modified": "2016-10-18T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:nghttp2", "cpe:/o:fedoraproject:fedora:22"], "id": "FEDORA_2016-8E13AC5754.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=89578", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2016-8e13ac5754.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(89578);\n script_version(\"$Revision: 1.2 $\");\n script_cvs_date(\"$Date: 2016/10/18 16:52:29 $\");\n\n script_cve_id(\"CVE-2015-8659\");\n script_xref(name:\"FEDORA\", value:\"2016-8e13ac5754\");\n\n script_name(english:\"Fedora 22 : nghttp2-1.6.0-1.fc22 (2016-8e13ac5754)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - update to nghttp2-1.6.0 (fixes CVE-2015-8659)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1295351\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2016-January/175423.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?b0a63992\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected nghttp2 package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:nghttp2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:22\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/03/04\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^22([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 22.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC22\", reference:\"nghttp2-1.6.0-1.fc22\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"nghttp2\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-09-02T00:05:01", "references": ["https://security.gentoo.org/glsa/201612-06"], "pluginID": "95521", "description": "The remote host is affected by the vulnerability described in GLSA-201612-06 (nghttp2: Heap-use-after-free)\n\n A heap-use-after-free vulnerability has been discovered in nghttp2.\n Please review the CVE identifier referenced below for details.\n Impact :\n\n The impact of the vulnerability is still unknown.\n Workaround :\n\n There is no known workaround at this time.", "edition": 4, "reporter": "Tenable", "published": "2016-12-05T00:00:00", "title": "GLSA-201612-06 : nghttp2: Heap-use-after-free", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Gentoo Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-8659"], "modified": "2016-12-05T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:nghttp2", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-201612-06.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=95521", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201612-06.\n#\n# The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(95521);\n script_version(\"$Revision: 3.1 $\");\n script_cvs_date(\"$Date: 2016/12/05 14:32:01 $\");\n\n script_cve_id(\"CVE-2015-8659\");\n script_xref(name:\"GLSA\", value:\"201612-06\");\n\n script_name(english:\"GLSA-201612-06 : nghttp2: Heap-use-after-free\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201612-06\n(nghttp2: Heap-use-after-free)\n\n A heap-use-after-free vulnerability has been discovered in nghttp2.\n Please review the CVE identifier referenced below for details.\n \nImpact :\n\n The impact of the vulnerability is still unknown.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201612-06\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All nghttp2 users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-libs/nghttp2-1.6.0'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:nghttp2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/12/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/12/05\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"net-libs/nghttp2\", unaffected:make_list(\"ge 1.6.0\"), vulnerable:make_list(\"lt 1.6.0\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"nghttp2\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-09-01T23:45:59", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=1295351", "http://www.nessus.org/u?e8526959"], "pluginID": "89545", "description": "- update to nghttp2-1.6.0 (fixes CVE-2015-8659)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "edition": 5, "reporter": "Tenable", "published": "2016-03-04T00:00:00", "title": "Fedora 23 : nghttp2-1.6.0-1.fc23 (2016-54f85ec6e8)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "Fedora Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-8659"], "modified": "2016-10-18T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:nghttp2", "cpe:/o:fedoraproject:fedora:23"], "id": "FEDORA_2016-54F85EC6E8.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=89545", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2016-54f85ec6e8.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(89545);\n script_version(\"$Revision: 1.2 $\");\n script_cvs_date(\"$Date: 2016/10/18 16:52:28 $\");\n\n script_cve_id(\"CVE-2015-8659\");\n script_xref(name:\"FEDORA\", value:\"2016-54f85ec6e8\");\n\n script_name(english:\"Fedora 23 : nghttp2-1.6.0-1.fc23 (2016-54f85ec6e8)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - update to nghttp2-1.6.0 (fixes CVE-2015-8659)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1295351\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2016-January/175085.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?e8526959\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected nghttp2 package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:nghttp2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:23\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/03/04\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^23([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 23.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC23\", reference:\"nghttp2-1.6.0-1.fc23\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"nghttp2\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-09-05T05:59:00", "references": ["http://www.nessus.org/u?ddcfe460", "https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/"], "pluginID": "88501", "description": "nghttp2 reports :\n\nThis release fixes heap-use-after-free bug in idle stream handling code. We strongly recommend to upgrade the older installation to this latest version as soon as possible.", "edition": 6, "reporter": "Tenable", "published": "2016-02-01T00:00:00", "title": "FreeBSD : nghttp2 -- use after free (93eadedb-c6a6-11e5-96d6-14dae9d210b8)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "FreeBSD Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-8659"], "modified": "2018-09-04T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:nghttp2", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_93EADEDBC6A611E596D614DAE9D210B8.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=88501", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(88501);\n script_version(\"2.4\");\n script_cvs_date(\"Date: 2018/09/04 13:20:07\");\n\n script_cve_id(\"CVE-2015-8659\");\n\n script_name(english:\"FreeBSD : nghttp2 -- use after free (93eadedb-c6a6-11e5-96d6-14dae9d210b8)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"nghttp2 reports :\n\nThis release fixes heap-use-after-free bug in idle stream handling\ncode. We strongly recommend to upgrade the older installation to this\nlatest version as soon as possible.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/\"\n );\n # http://www.freebsd.org/ports/portaudit/93eadedb-c6a6-11e5-96d6-14dae9d210b8.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?ddcfe460\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:nghttp2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/12/23\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/02/01\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"nghttp2<1.6.0\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-09-02T00:01:20", "references": ["https://support.apple.com/en-us/HT206169", "http://www.nessus.org/u?5c691f32"], "pluginID": "90309", "description": "According to its banner, the remote Apple TV device is a version prior to 9.2. It is, therefore, affected by the following vulnerabilities :\n\n - An XML external entity (XXE) expansion flaw exists in libxml2 due to the XML parser accepting entities from untrusted sources. An unauthenticated, remote attacker can exploit this, via crafted XML data, to cause a denial of service through resource exhaustion.\n (CVE-2015-1819)\n\n - An XML external entity (XXE) injection flaw exists in libxml2 in file parser.c due to the XML parser accepting entities from untrusted sources. An unauthenticated, remote attacker can exploit this, via crafted XML data, to cause a denial of service or to disclose sensitive information. (CVE-2015-5312)\n\n - A heap buffer overflow condition exists in libxml2 in the xmlGROW() function within file parser.c while handling XML data. An unauthenticated, remote attacker can exploit this to disclose sensitive information.\n (CVE-2015-7499)\n\n - An out-of-bounds heap read error exists in libxml2 in the xmlParseMisc() function within file parser.c while handling entity boundaries. An unauthenticated, remote attacker can exploit this to cause a denial of service.\n (CVE-2015-7500)\n\n - An out-of-bounds read error exists in libxml2 in the xmlParseConditionalSections() function within file parser.c due to a failure to properly skip intermediary entities when it stops parsing invalid input. An unauthenticated, remote attacker can exploit this, via crafted XML data, to cause a denial of service.\n (CVE-2015-7942)\n\n - A flaw exists in libxml2 in the xz_decomp() function within file xzlib.c due to a failure to properly detect compression errors when handling compressed XML content.\n An unauthenticated, remote attacker can exploit this, via crafted XML data, to cause an infinite loop, resulting in a denial of service.\n (CVE-2015-8035)\n\n - A out-of-bounds read error exists in libxml2 in the xmlSAX2TextNode() function within file SAX2.c due to improper sanitization of input data. An unauthenticated, remote attacker can exploit this, via crafted XML data, to cause a denial of service or to disclose sensitive information. (CVE-2015-8242)\n\n - A use-after-free error exists in Nghttp2 within file lib/nghttp2_session.c when handling idle streams. An unauthenticated, remote attacker can exploit this to deference already freed memory, allowing the execution of arbitrary code. (CVE-2015-8659)\n\n - An overflow condition exists in the Broadcom Wi-Fi driver due to improper validation of data while handling SSID or WPS_ID_DEVICE_NAME values. An unauthenticated, adjacent attacker can exploit this, via a crafted wireless control message packet, to cause a denial of service or to execute arbitrary code. (CVE-2016-0801)\n\n - An overflow condition exists in the Broadcom Wi-Fi driver due to improper validation of user-supplied input when handling the packet length of event messages.\n An unauthenticated, adjacent attacker can exploit this, via a crafted wireless control message packet, to cause a denial of service or to execute arbitrary code.\n (CVE-2016-0802)\n\n - A flaw exists in FontParser due to improper validation of user-supplied input when handling encoded fonts that contain invalid characters. An unauthenticated, remote attacker can exploit this, via a crafted PDF document, to corrupt memory, resulting in a denial of service or the execution arbitrary code. (CVE-2016-1740)\n\n - A flaw exists in IOHIDFamily due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a crafted application, to gain access to kernel memory layout information.\n (CVE-2016-1748)\n\n - A use-after-free error exists in the kernel that allows an unauthenticated, remote attacker to execute arbitrary code via a crafted application. (CVE-2016-1750)\n\n - A flaw exists in the kernel due to a failure to properly restrict execution permissions. An unauthenticated, remote attacker can exploit this, via a crafted application, to bypass code-signing protection mechanisms. (CVE-2016-1751)\n\n - An unspecified flaw exists in the kernel that allows a local attacker to cause a denial of service via a crafted application. (CVE-2016-1752)\n\n - An integer overflow condition exists in the kernel due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a crafted application, to gain elevated privileges.\n (CVE-2016-1753)\n\n - A memory corruption issue exists in the kernel due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to install a malicious application, to cause a denial of service or execute arbitrary code.\n CVE-2016-1754)\n\n - A use-after-free error exists in the AppleKeyStore user client when handling multiple threads, which is triggered when one thread closes the user client while another attempts to call an external method. An unauthenticated, remote attacker can exploit this, by convincing a user to install a malicious application, to execute arbitrary code with elevated privileges.\n (CVE-2016-1755)\n\n - A flaw exists in libxml2 due to improper validation of user-supplied input while handling XML content. An unauthenticated, remote attacker can exploit this, via a crafted XML document, to cause a denial of service or to execute arbitrary code. (CVE-2016-1762)\n\n - An out-of-bounds write error exists in TrueTypeScaler due to improper validation of user-supplied input while handling bdat tables in TTF fonts. An unauthenticated, remote attacker can exploit this, via a crafted TTF font, to cause a denial or service or to execute arbitrary code. (CVE-2016-1775)\n\n - A flaw exists in WebKit due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a crafted website, to cause a denial of service or execute arbitrary code.\n (CVE-2016-1783)\n\n - An unspecified flaw exists in the History implementation of WebKit that allows an unauthenticated, remote attacker to cause a denial of service via a crafted website. (CVE-2016-1784)\n\n - A heap buffer overflow condition exists in Mozilla Network Security Services due to improper validation of user-supplied input while parsing ASN.1 structures. An unauthenticated, remote attacker can exploit this, via crafted ASN.1 data in an X.509 certificate, to cause a denial of service or execute arbitrary code.\n (CVE-2016-1950)\n\nNote that only 4th generation models are affected by these vulnerabilities, and this plugin only checks these models.", "edition": 10, "reporter": "Tenable", "published": "2016-04-01T00:00:00", "title": "Apple TV < 9.2 Multiple Vulnerabilities", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 9.3}}, "naslFamily": "Misc.", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-8659", "CVE-2016-1783", "CVE-2015-5312", "CVE-2016-1762", "CVE-2016-1752", "CVE-2016-1740", "CVE-2016-1775", "CVE-2015-7500", "CVE-2016-0802", "CVE-2015-8242", "CVE-2015-1819", "CVE-2015-7499", "CVE-2016-1754", "CVE-2016-1950", "CVE-2016-1750", "CVE-2016-1748", "CVE-2016-0801", "CVE-2016-1755", "CVE-2016-1751", "CVE-2016-1784", "CVE-2016-1753", "CVE-2015-7942", "CVE-2015-8035"], "modified": "2018-06-29T00:00:00", "cpe": ["cpe:/a:apple:apple_tv"], "id": "APPLETV_9_2.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=90309", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(90309);\n script_version(\"1.12\");\n script_cvs_date(\"Date: 2018/06/29 12:01:01\");\n\n script_cve_id(\n \"CVE-2015-1819\",\n \"CVE-2015-5312\",\n \"CVE-2015-7499\",\n \"CVE-2015-7500\",\n \"CVE-2015-7942\",\n \"CVE-2015-8035\",\n \"CVE-2015-8242\",\n \"CVE-2015-8659\",\n \"CVE-2016-0801\",\n \"CVE-2016-0802\",\n \"CVE-2016-1740\",\n \"CVE-2016-1748\",\n \"CVE-2016-1750\",\n \"CVE-2016-1751\",\n \"CVE-2016-1752\",\n \"CVE-2016-1753\",\n \"CVE-2016-1754\",\n \"CVE-2016-1755\",\n \"CVE-2016-1762\",\n \"CVE-2016-1775\",\n \"CVE-2016-1783\",\n \"CVE-2016-1784\",\n \"CVE-2016-1950\"\n );\n script_bugtraq_id(\n 75570,\n 77390,\n 77681,\n 79507,\n 79509,\n 79536,\n 79562,\n 80438\n );\n script_xref(name:\"APPLE-SA\", value:\"APPLE-SA-2016-03-21-3\");\n\n script_name(english:\"Apple TV < 9.2 Multiple Vulnerabilities\");\n script_summary(english:\"Checks the build number.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote device is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its banner, the remote Apple TV device is a version prior\nto 9.2. It is, therefore, affected by the following vulnerabilities :\n\n - An XML external entity (XXE) expansion flaw exists in\n libxml2 due to the XML parser accepting entities from\n untrusted sources. An unauthenticated, remote attacker\n can exploit this, via crafted XML data, to cause a\n denial of service through resource exhaustion.\n (CVE-2015-1819)\n\n - An XML external entity (XXE) injection flaw exists in\n libxml2 in file parser.c due to the XML parser accepting\n entities from untrusted sources. An unauthenticated,\n remote attacker can exploit this, via crafted XML data,\n to cause a denial of service or to disclose sensitive\n information. (CVE-2015-5312)\n\n - A heap buffer overflow condition exists in libxml2 in\n the xmlGROW() function within file parser.c while\n handling XML data. An unauthenticated, remote attacker\n can exploit this to disclose sensitive information.\n (CVE-2015-7499)\n\n - An out-of-bounds heap read error exists in libxml2 in\n the xmlParseMisc() function within file parser.c while\n handling entity boundaries. An unauthenticated, remote\n attacker can exploit this to cause a denial of service.\n (CVE-2015-7500)\n\n - An out-of-bounds read error exists in libxml2 in the\n xmlParseConditionalSections() function within file\n parser.c due to a failure to properly skip intermediary\n entities when it stops parsing invalid input. An\n unauthenticated, remote attacker can exploit this, via\n crafted XML data, to cause a denial of service.\n (CVE-2015-7942)\n\n - A flaw exists in libxml2 in the xz_decomp() function\n within file xzlib.c due to a failure to properly detect\n compression errors when handling compressed XML content.\n An unauthenticated, remote attacker can exploit this,\n via crafted XML data, to cause an infinite loop,\n resulting in a denial of service.\n (CVE-2015-8035)\n\n - A out-of-bounds read error exists in libxml2 in the\n xmlSAX2TextNode() function within file SAX2.c due to\n improper sanitization of input data. An unauthenticated,\n remote attacker can exploit this, via crafted XML data,\n to cause a denial of service or to disclose sensitive\n information. (CVE-2015-8242)\n\n - A use-after-free error exists in Nghttp2 within file\n lib/nghttp2_session.c when handling idle streams. An\n unauthenticated, remote attacker can exploit this to\n deference already freed memory, allowing the execution\n of arbitrary code. (CVE-2015-8659)\n\n - An overflow condition exists in the Broadcom Wi-Fi\n driver due to improper validation of data while handling\n SSID or WPS_ID_DEVICE_NAME values. An unauthenticated,\n adjacent attacker can exploit this, via a crafted\n wireless control message packet, to cause a denial of\n service or to execute arbitrary code. (CVE-2016-0801)\n\n - An overflow condition exists in the Broadcom Wi-Fi\n driver due to improper validation of user-supplied\n input when handling the packet length of event messages.\n An unauthenticated, adjacent attacker can exploit this,\n via a crafted wireless control message packet, to cause\n a denial of service or to execute arbitrary code.\n (CVE-2016-0802)\n\n - A flaw exists in FontParser due to improper validation\n of user-supplied input when handling encoded fonts that\n contain invalid characters. An unauthenticated, remote\n attacker can exploit this, via a crafted PDF document,\n to corrupt memory, resulting in a denial of service or\n the execution arbitrary code. (CVE-2016-1740)\n\n - A flaw exists in IOHIDFamily due to improper validation\n of user-supplied input. An unauthenticated, remote\n attacker can exploit this, via a crafted application,\n to gain access to kernel memory layout information.\n (CVE-2016-1748)\n\n - A use-after-free error exists in the kernel that allows\n an unauthenticated, remote attacker to execute arbitrary\n code via a crafted application. (CVE-2016-1750)\n\n - A flaw exists in the kernel due to a failure to properly\n restrict execution permissions. An unauthenticated,\n remote attacker can exploit this, via a crafted\n application, to bypass code-signing protection\n mechanisms. (CVE-2016-1751)\n\n - An unspecified flaw exists in the kernel that allows a\n local attacker to cause a denial of service via a\n crafted application. (CVE-2016-1752)\n\n - An integer overflow condition exists in the kernel due\n to improper validation of user-supplied input. An\n unauthenticated, remote attacker can exploit this, via\n a crafted application, to gain elevated privileges.\n (CVE-2016-1753)\n\n - A memory corruption issue exists in the kernel due to\n improper validation of user-supplied input. An\n unauthenticated, remote attacker can exploit this, by\n convincing a user to install a malicious application,\n to cause a denial of service or execute arbitrary code.\n CVE-2016-1754)\n\n - A use-after-free error exists in the AppleKeyStore user\n client when handling multiple threads, which is\n triggered when one thread closes the user client while\n another attempts to call an external method. An\n unauthenticated, remote attacker can exploit this, by\n convincing a user to install a malicious application, to\n execute arbitrary code with elevated privileges.\n (CVE-2016-1755)\n\n - A flaw exists in libxml2 due to improper validation of\n user-supplied input while handling XML content. An\n unauthenticated, remote attacker can exploit this, via a\n crafted XML document, to cause a denial of service or to\n execute arbitrary code. (CVE-2016-1762)\n\n - An out-of-bounds write error exists in TrueTypeScaler\n due to improper validation of user-supplied input while\n handling bdat tables in TTF fonts. An unauthenticated,\n remote attacker can exploit this, via a crafted TTF\n font, to cause a denial or service or to execute\n arbitrary code. (CVE-2016-1775)\n\n - A flaw exists in WebKit due to improper validation of\n user-supplied input. An unauthenticated, remote attacker\n can exploit this, via a crafted website, to cause a\n denial of service or execute arbitrary code.\n (CVE-2016-1783)\n\n - An unspecified flaw exists in the History implementation\n of WebKit that allows an unauthenticated, remote\n attacker to cause a denial of service via a crafted\n website. (CVE-2016-1784)\n\n - A heap buffer overflow condition exists in Mozilla\n Network Security Services due to improper validation of\n user-supplied input while parsing ASN.1 structures. An\n unauthenticated, remote attacker can exploit this, via\n crafted ASN.1 data in an X.509 certificate, to cause a\n denial of service or execute arbitrary code.\n (CVE-2016-1950)\n\nNote that only 4th generation models are affected by these\nvulnerabilities, and this plugin only checks these models.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.apple.com/en-us/HT206169\");\n # http://prod.lists.apple.com/archives/security-announce/2016/Mar/msg00002.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?5c691f32\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Apple TV version 9.2 or later. Note that this update is\navailable only for 4th generation models.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/02/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/03/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/04/01\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:apple:apple_tv\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Misc.\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"appletv_version.nasl\");\n script_require_keys(\"AppleTV/Version\", \"AppleTV/URL\", \"AppleTV/Port\");\n script_require_ports(\"Services/www\", 7000);\n\n exit(0);\n}\n\ninclude(\"appletv_func.inc\");\ninclude(\"audit.inc\");\n\nurl = get_kb_item('AppleTV/URL');\nif (empty_or_null(url)) exit(0, 'Cannot determine Apple TV URL.');\nport = get_kb_item('AppleTV/Port');\nif (empty_or_null(port)) exit(0, 'Cannot determine Apple TV port.');\n\nbuild = get_kb_item('AppleTV/Version');\nif (empty_or_null(build)) audit(AUDIT_UNKNOWN_DEVICE_VER, 'Apple TV');\n\nmodel = get_kb_item('AppleTV/Model');\nif (empty_or_null(model)) exit(0, 'Cannot determine Apple TV model.');\n\n# fix\nfixed_build = \"13Y234\";\ntvos_ver = \"9.2\"; # for reporting purposes only\ngen = 4; # apple tv generation\n\nappletv_check_version(\n build : build,\n fix : fixed_build,\n fix_tvos_ver : tvos_ver,\n model : model,\n gen : gen,\n severity : SECURITY_HOLE,\n port : port,\n url : url\n);\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-09-01T23:56:27", "references": ["http://www.nessus.org/u?6c87f79a", "https://support.apple.com/en-us/HT206167"], "pluginID": "90096", "description": "The remote host is running a version of Mac OS X that is 10.11.x prior to 10.11.4. It is, therefore, affected by multiple vulnerabilities in the following components :\n\n - apache_mod_php\n - AppleRAID\n - AppleUSBNetworking\n - Bluetooth\n - Carbon\n - dyld\n - FontParser\n - HTTPProtocol\n - Intel Graphics Driver\n - IOFireWireFamily\n - IOGraphics\n - IOHIDFamily\n - IOUSBFamily\n - Kernel\n - libxml2\n - Messages\n - NVIDIA Graphics Drivers\n - OpenSSH\n - OpenSSL\n - Python\n - QuickTime\n - Reminders\n - Ruby\n - Security\n - Tcl\n - TrueTypeScaler\n - Wi-Fi\n\nNote that successful exploitation of the most serious issues can result in arbitrary code execution.", "edition": 5, "reporter": "Tenable", "published": "2016-03-22T00:00:00", "title": "Mac OS X 10.11.x < 10.11.4 Multiple Vulnerabilities", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "MacOS X Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2016-1746", "CVE-2016-1734", "CVE-2015-8659", "CVE-2016-1773", "CVE-2015-8126", "CVE-2016-1768", "CVE-2016-1758", "CVE-2015-5312", "CVE-2016-1761", "CVE-2015-3195", "CVE-2016-1744", "CVE-2016-1762", "CVE-2016-1737", "CVE-2015-7551", "CVE-2016-1738", "CVE-2016-1756", "CVE-2016-1747", "CVE-2016-1752", "CVE-2016-1736", "CVE-2016-1740", "CVE-2016-1743", "CVE-2016-1775", "CVE-2016-1749", "CVE-2015-7500", "CVE-2016-0802", "CVE-2015-8242", "CVE-2016-1770", "CVE-2016-1757", "CVE-2015-1819", "CVE-2015-7499", "CVE-2016-1741", "CVE-2016-1759", "CVE-2016-1745", "CVE-2016-1732", "CVE-2016-1769", "CVE-2016-1754", "CVE-2015-0973", "CVE-2016-1950", "CVE-2016-1750", "CVE-2016-1748", "CVE-2014-9495", "CVE-2016-0801", "CVE-2015-8472", "CVE-2016-1764", "CVE-2016-0778", "CVE-2016-1755", "CVE-2016-1767", "CVE-2016-1753", "CVE-2016-1733", "CVE-2016-1788", "CVE-2016-1735", "CVE-2015-7942", "CVE-2015-8035", "CVE-2016-0777"], "modified": "2018-07-14T00:00:00", "cpe": ["cpe:/o:apple:mac_os_x"], "id": "MACOSX_10_11_4.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=90096", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(90096);\n script_version(\"1.15\");\n script_cvs_date(\"Date: 2018/07/14 1:59:36\");\n\n script_cve_id(\n \"CVE-2014-9495\",\n \"CVE-2015-0973\",\n \"CVE-2015-1819\",\n \"CVE-2015-3195\",\n \"CVE-2015-5312\",\n \"CVE-2015-7499\",\n \"CVE-2015-7500\",\n \"CVE-2015-7551\",\n \"CVE-2015-7942\",\n \"CVE-2015-8035\",\n \"CVE-2015-8126\",\n \"CVE-2015-8242\",\n \"CVE-2015-8472\",\n \"CVE-2015-8659\",\n \"CVE-2016-0777\",\n \"CVE-2016-0778\",\n \"CVE-2016-0801\",\n \"CVE-2016-0802\",\n \"CVE-2016-1732\",\n \"CVE-2016-1733\",\n \"CVE-2016-1734\",\n \"CVE-2016-1735\",\n \"CVE-2016-1736\",\n \"CVE-2016-1737\",\n \"CVE-2016-1738\",\n \"CVE-2016-1740\",\n \"CVE-2016-1741\",\n \"CVE-2016-1743\",\n \"CVE-2016-1744\",\n \"CVE-2016-1745\",\n \"CVE-2016-1746\",\n \"CVE-2016-1747\",\n \"CVE-2016-1748\",\n \"CVE-2016-1749\",\n \"CVE-2016-1750\",\n \"CVE-2016-1752\",\n \"CVE-2016-1753\",\n \"CVE-2016-1754\",\n \"CVE-2016-1755\",\n \"CVE-2016-1756\",\n \"CVE-2016-1757\",\n \"CVE-2016-1758\",\n \"CVE-2016-1759\",\n \"CVE-2016-1761\",\n \"CVE-2016-1762\",\n \"CVE-2016-1764\",\n \"CVE-2016-1767\",\n \"CVE-2016-1768\",\n \"CVE-2016-1769\",\n \"CVE-2016-1770\",\n \"CVE-2016-1773\",\n \"CVE-2016-1775\",\n \"CVE-2016-1788\",\n \"CVE-2016-1950\"\n );\n script_bugtraq_id(\n 71820,\n 71994,\n 75570,\n 77390,\n 77568,\n 77681,\n 78624,\n 78626,\n 79507,\n 79509,\n 79536,\n 79562,\n 80438,\n 80695,\n 80698\n );\n script_xref(name:\"APPLE-SA\", value:\"APPLE-SA-2016-03-21-5\");\n\n script_name(english:\"Mac OS X 10.11.x < 10.11.4 Multiple Vulnerabilities\");\n script_summary(english:\"Checks the version of Mac OS X.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Mac OS X host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running a version of Mac OS X that is 10.11.x prior\nto 10.11.4. It is, therefore, affected by multiple vulnerabilities in\nthe following components :\n\n - apache_mod_php\n - AppleRAID\n - AppleUSBNetworking\n - Bluetooth\n - Carbon\n - dyld\n - FontParser\n - HTTPProtocol\n - Intel Graphics Driver\n - IOFireWireFamily\n - IOGraphics\n - IOHIDFamily\n - IOUSBFamily\n - Kernel\n - libxml2\n - Messages\n - NVIDIA Graphics Drivers\n - OpenSSH\n - OpenSSL\n - Python\n - QuickTime\n - Reminders\n - Ruby\n - Security\n - Tcl\n - TrueTypeScaler\n - Wi-Fi\n\nNote that successful exploitation of the most serious issues can\nresult in arbitrary code execution.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.apple.com/en-us/HT206167\");\n # http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?6c87f79a\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Mac OS X version 10.11.4 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/12/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/03/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/03/22\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"combined\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:apple:mac_os_x\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"os_fingerprint.nasl\");\n script_require_ports(\"Host/MacOSX/Version\", \"Host/OS\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\nos = get_kb_item(\"Host/MacOSX/Version\");\nif (!os)\n{\n os = get_kb_item_or_exit(\"Host/OS\");\n if (\"Mac OS X\" >!< os)\n audit(AUDIT_OS_NOT, \"Mac OS X\");\n\n c = get_kb_item(\"Host/OS/Confidence\");\n if (c <= 70)\n exit(1, \"Cannot determine the host's OS with sufficient confidence.\");\n}\nif (!os)\n audit(AUDIT_OS_NOT, \"Mac OS X\");\n\nmatch = eregmatch(pattern:\"Mac OS X ([0-9]+(\\.[0-9]+)+)\", string:os);\nif (isnull(match)) exit(1, \"Failed to parse the Mac OS X version ('\" + os + \"').\");\n\nversion = match[1];\n\nif (\n version !~ \"^10\\.11([^0-9]|$)\"\n) audit(AUDIT_OS_NOT, \"Mac OS X 10.11 or later\", \"Mac OS X \"+version);\n\nfix = \"10.11.4\";\nif (ver_compare(ver:version, fix:fix, strict:FALSE) == -1)\n{\n items = make_array(\"Installed version\", version,\n \"Fixed version\", fix\n );\n order = make_list(\"Installed version\", \"Fixed version\");\n report = report_items_str(report_items:items, ordered_fields:order);\n\n security_report_v4(port:0, extra:report, severity:SECURITY_HOLE);\n exit(0);\n\n }\nelse\n audit(AUDIT_INST_VER_NOT_VULN, \"Mac OS X\", version);\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "openvas": [{"lastseen": "2018-09-01T23:45:40", "references": ["https://lists.fedoraproject.org/pipermail/package-announce/2016-January/175423.html", "2016-8"], "pluginID": "1361412562310807105", "description": "Check the version of nghttp2", "edition": 4, "reporter": "Copyright (C) 2016 Greenbone Networks GmbH", "published": "2016-01-13T00:00:00", "title": "Fedora Update for nghttp2 FEDORA-2016-8", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Fedora Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-8659"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:1361412562310807105", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310807105", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for nghttp2 FEDORA-2016-8\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.807105\");\n script_version(\"$Revision: 6631 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:36:10 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2016-01-13 06:13:58 +0100 (Wed, 13 Jan 2016)\");\n script_cve_id(\"CVE-2015-8659\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for nghttp2 FEDORA-2016-8\");\n script_tag(name: \"summary\", value: \"Check the version of nghttp2\");\n script_tag(name: \"vuldetect\", value: \"Get the installed version with the help of detect NVT and check if the version is vulnerable or not.\");\n script_tag(name: \"insight\", value: \"This package contains the HTTP/2 client, server and proxy programs.\n\");\n script_tag(name: \"affected\", value: \"nghttp2 on Fedora 22\");\n script_tag(name: \"solution\", value: \"Please Install the Updated Packages.\");\n\n script_xref(name: \"FEDORA\", value: \"2016-8\");\n script_xref(name: \"URL\" , value: \"https://lists.fedoraproject.org/pipermail/package-announce/2016-January/175423.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC22\")\n{\n\n if ((res = isrpmvuln(pkg:\"nghttp2\", rpm:\"nghttp2~1.6.0~1.fc22\", rls:\"FC22\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-09-01T23:46:43", "references": ["https://lists.fedoraproject.org/pipermail/package-announce/2016-January/175085.html", "2016-54"], "pluginID": "1361412562310806942", "description": "Check the version of nghttp2", "edition": 4, "reporter": "Copyright (C) 2016 Greenbone Networks GmbH", "published": "2016-01-08T00:00:00", "title": "Fedora Update for nghttp2 FEDORA-2016-54", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Fedora Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-8659"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:1361412562310806942", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310806942", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for nghttp2 FEDORA-2016-54\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.806942\");\n script_version(\"$Revision: 6632 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:48:18 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2016-01-08 06:29:48 +0100 (Fri, 08 Jan 2016)\");\n script_cve_id(\"CVE-2015-8659\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for nghttp2 FEDORA-2016-54\");\n script_tag(name: \"summary\", value: \"Check the version of nghttp2\");\n\n script_tag(name: \"vuldetect\", value: \"Get the installed version with the help\n of detect NVT and check if the version is vulnerable or not.\");\n\n script_tag(name: \"insight\", value: \"This package contains the HTTP/2 client,\n server and proxy programs.\");\n\n script_tag(name: \"affected\", value: \"nghttp2 on Fedora 23\");\n script_tag(name: \"solution\", value: \"Please Install the Updated Packages.\");\n\n script_xref(name: \"FEDORA\", value: \"2016-54\");\n script_xref(name: \"URL\" , value: \"https://lists.fedoraproject.org/pipermail/package-announce/2016-January/175085.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC23\")\n{\n\n if ((res = isrpmvuln(pkg:\"nghttp2\", rpm:\"nghttp2~1.6.0~1.fc23\", rls:\"FC23\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-09-01T23:46:49", "references": ["https://support.apple.com/en-us/HT206167"], "pluginID": "1361412562310806693", "description": "This host is running Apple Mac OS X and\n is prone to multiple vulnerabilities.", "edition": 4, "reporter": "Copyright (C) 2016 Greenbone Networks GmbH", "published": "2016-04-01T00:00:00", "title": "Apple Mac OS X Multiple Vulnerabilities-01 March-2016", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Mac OS X Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2016-1746", "CVE-2016-1734", "CVE-2015-8659", "CVE-2016-1773", "CVE-2015-8126", "CVE-2016-1768", "CVE-2016-1758", "CVE-2015-5312", "CVE-2016-1761", "CVE-2015-3195", "CVE-2016-1744", "CVE-2016-1762", "CVE-2016-1737", "CVE-2016-1765", "CVE-2015-7551", "CVE-2016-1738", "CVE-2016-1756", "CVE-2016-1747", "CVE-2016-1752", "CVE-2016-1736", "CVE-2016-1740", "CVE-2016-1743", "CVE-2016-1775", "CVE-2016-1749", "CVE-2015-7500", "CVE-2016-0802", "CVE-2015-8242", "CVE-2016-1770", "CVE-2016-1757", "CVE-2015-1819", "CVE-2015-7499", "CVE-2016-1741", "CVE-2016-1759", "CVE-2016-1745", "CVE-2016-1732", "CVE-2016-1769", "CVE-2016-1754", "CVE-2015-0973", "CVE-2016-1950", "CVE-2016-1750", "CVE-2016-1748", "CVE-2014-9495", "CVE-2016-0801", "CVE-2015-8472", "CVE-2016-1764", "CVE-2016-0778", "CVE-2016-1755", "CVE-2016-1767", "CVE-2016-1753", "CVE-2016-1733", "CVE-2016-1788", "CVE-2016-1735", "CVE-2015-7942", "CVE-2015-8035", "CVE-2016-0777"], "modified": "2018-05-23T00:00:00", "id": "OPENVAS:1361412562310806693", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310806693", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_apple_macosx_mult_vuln01_mar16.nasl 9935 2018-05-23 13:15:24Z santu $\n#\n# Apple Mac OS X Multiple Vulnerabilities-01 March-2016\n#\n# Authors:\n# Shakeel <bshakeel@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.806693\");\n script_version(\"$Revision: 9935 $\");\n script_cve_id(\"CVE-2015-7551\", \"CVE-2016-1733\", \"CVE-2016-1732\", \"CVE-2016-1734\",\n \"CVE-2016-1735\", \"CVE-2016-1736\", \"CVE-2016-1737\", \"CVE-2016-1740\",\n \"CVE-2016-1738\", \"CVE-2016-1741\", \"CVE-2016-1743\", \"CVE-2016-1744\",\n \"CVE-2016-1745\", \"CVE-2016-1746\", \"CVE-2016-1747\", \"CVE-2016-1748\",\n \"CVE-2016-1749\", \"CVE-2016-1752\", \"CVE-2016-1753\", \"CVE-2016-1754\",\n \"CVE-2016-1755\", \"CVE-2016-1756\", \"CVE-2016-1757\", \"CVE-2016-1758\",\n \"CVE-2016-1759\", \"CVE-2016-1761\", \"CVE-2016-1764\", \"CVE-2016-1765\",\n \"CVE-2016-1767\", \"CVE-2016-1768\", \"CVE-2016-1769\", \"CVE-2016-1770\",\n \"CVE-2016-1773\", \"CVE-2016-1775\", \"CVE-2016-1750\", \"CVE-2016-1788\",\n \"CVE-2015-8126\", \"CVE-2015-8472\", \"CVE-2015-8659\", \"CVE-2015-1819\",\n \"CVE-2015-5312\", \"CVE-2015-7499\", \"CVE-2015-7500\", \"CVE-2015-7942\",\n \"CVE-2015-8035\", \"CVE-2015-8242\", \"CVE-2016-1762\", \"CVE-2016-0777\",\n \"CVE-2016-0778\", \"CVE-2015-3195\", \"CVE-2014-9495\", \"CVE-2015-0973\",\n \"CVE-2016-1950\", \"CVE-2016-0801\", \"CVE-2016-0802\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-05-23 15:15:24 +0200 (Wed, 23 May 2018) $\");\n script_tag(name:\"creation_date\", value:\"2016-04-01 13:19:28 +0530 (Fri, 01 Apr 2016)\");\n script_name(\"Apple Mac OS X Multiple Vulnerabilities-01 March-2016\");\n\n script_tag(name: \"summary\" , value:\"This host is running Apple Mac OS X and\n is prone to multiple vulnerabilities.\");\n\n script_tag(name: \"vuldetect\" , value:\"Get the installed version with the help\n of detect NVT and check the version is vulnerable or not.\");\n\n script_tag(name: \"insight\" , value:\"Multiple flaws exists. For details\n refer the reference links.\");\n\n script_tag(name: \"impact\" , value:\"Successful exploitation will allow attacker\n to execute arbitrary code or cause a denial of service (memory corruption),\n gain access to potentially sensitive information, trigger a dialing action,\n bypass a code-signing protection mechanism.\n\n Impact Level: System\");\n\n script_tag(name: \"affected\" , value:\"Apple Mac OS X versions 10.11.x before\n 10.11.4, 10.9.x through 10.9.5, 10.10.x through 10.10.5\");\n\n script_tag(name: \"solution\" , value:\"Upgrade to Apple Mac OS X version\n 10.11.4 or later, or apply aptch from vendor. For more updates refer\n to https://www.apple.com\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name : \"URL\" , value : \"https://support.apple.com/en-us/HT206167\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Mac OS X Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/osx_name\", \"ssh/login/osx_version\");\n exit(0);\n}\n\n\ninclude(\"version_func.inc\");\n\nosName = get_kb_item(\"ssh/login/osx_name\");\nif(!osName || \"Mac OS X\" >!< osName){\n exit(0);\n}\n\nosVer = get_kb_item(\"ssh/login/osx_version\");\nif(!osVer || osVer !~ \"^(10\\.(9|10|11))\"){\n exit(0);\n}\n\nif(version_in_range(version:osVer, test_version:\"10.9\", test_version2:\"10.9.4\")||\n version_in_range(version:osVer, test_version:\"10.10\", test_version2:\"10.10.4\")){\n fix = \"Upgrade to latest OS release and apply patch from vendor\";\n}\n\nelse if((osVer == \"10.10.5\") || (osVer == \"10.9.5\"))\n{\n buildVer = get_kb_item(\"ssh/login/osx_build\");\n if(!buildVer){\n exit(0);\n }\n if(osVer == \"10.10.5\" && version_is_less(version:buildVer, test_version:\"14F1713\"))\n {\n fix = \"Apply patch from vendor\";\n osVer = osVer + \" Build \" + buildVer;\n }\n else if(osVer == \"10.9.5\" && version_is_less(version:buildVer, test_version:\"13F1712\"))\n {\n fix = \"Apply patch from vendor\";\n osVer = osVer + \" Build \" + buildVer;\n }\n}\n\nelse if(osVer =~ \"^(10\\.11)\")\n{\n if(version_is_less(version:osVer, test_version:\"10.11.4\")){\n fix = \"10.11.4\";\n }\n}\n\nif(fix)\n{\n report = report_fixed_ver(installed_version:osVer, fixed_version:fix);\n security_message(data:report);\n exit(0);\n}\nexit(0);\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "gentoo": [{"lastseen": "2016-12-04T12:54:41", "references": ["http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8659", "https://bugs.gentoo.org/show_bug.cgi?id=569518"], "affectedPackage": [{"OS": "Gentoo", "OSVersion": "any", "packageVersion": "1.6.0", "arch": "all", "packageName": "net-libs/nghttp2", "packageFilename": "UNKNOWN", "operator": "lt"}], "edition": 1, "description": "### Background\n\nNghttp2 is an implementation of HTTP/2 and its header compression algorithm HPACK in C. \n\n### Description\n\nA heap-use-after-free vulnerability has been discovered in nghttp2. Please review the CVE identifier referenced below for details. \n\n### Impact\n\nThe impact of the vulnerability is still unknown.\n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll nghttp2 users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-libs/nghttp2-1.6.0\"", "reporter": "Gentoo Foundation", "published": "2016-12-04T00:00:00", "type": "gentoo", "title": "nghttp2: Heap-use-after-free", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "bulletinFamily": "unix", "cvelist": ["CVE-2015-8659"], "modified": "2016-12-04T00:00:00", "href": "https://security.gentoo.org/glsa/201612-06", "id": "GLSA-201612-06", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "freebsd": [{"lastseen": "2018-08-31T01:14:24", "references": ["https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/"], "affectedPackage": [{"OS": "FreeBSD", "OSVersion": "any", "packageVersion": "1.6.0", "arch": "noarch", "packageFilename": "UNKNOWN", "packageName": "nghttp2", "operator": "lt"}], "description": "\nnghttp2 reports:\n\nThis release fixes heap-use-after-free bug in idle stream\n\t handling code. We strongly recommend to upgrade the older installation\n\t to this latest version as soon as possible.\n\n", "edition": 3, "reporter": "FreeBSD", "published": "2015-12-23T00:00:00", "title": "nghttp2 -- use after free", "type": "freebsd", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "bulletinFamily": "unix", "cvelist": ["CVE-2015-8659"], "modified": "2015-12-23T00:00:00", "id": "93EADEDB-C6A6-11E5-96D6-14DAE9D210B8", "href": "https://vuxml.freebsd.org/freebsd/93eadedb-c6a6-11e5-96d6-14dae9d210b8.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "archlinux": [{"lastseen": "2016-09-02T18:44:40", "references": ["https://github.com/tatsuhiro-t/nghttp2/commit/92a56d034f201cbb609606184822cf1716677207", "https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/", "https://access.redhat.com/security/cve/CVE-2015-8659", "http://seclists.org/oss-sec/2015/q4/576"], "affectedPackage": [{"OS": "any", "OSVersion": "any", "packageVersion": "1.6.0-1", "packageFilename": "UNKNOWN", "packageName": "nghttp2", "arch": "any", "operator": "lt"}], "edition": 1, "description": "nghttp2 1.6.0 fixes a heap-based use-after-free bug in idle stream\nhandling code, where an idle/closed stream could possibly be destroyed\nwhile it was still referenced.", "reporter": "Arch Linux", "published": "2015-12-25T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "title": "nghttp2: use-after-free", "type": "archlinux", "bulletinFamily": "unix", "cvelist": ["CVE-2015-8659"], "modified": "2015-12-25T00:00:00", "href": "https://lists.archlinux.org/pipermail/arch-security/2015-December/000476.html", "id": "ASA-201512-16", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "thn": [{"lastseen": "2018-07-15T06:56:41", "_object_types": ["robots.models.thn.ThnBulletin", "robots.models.base.Bulletin"], "references": [], "description": "[](<https://1.bp.blogspot.com/-Lwd_kzndPGI/V6JOCkxW1wI/AAAAAAAApDE/I69ZkMsBczwYHWh7F85dITwXIT1w6ZQuQCLcB/s728-e100/http2.png>)\n\nIf you think that the [HTTP/2 protocol](<https://thehackernews.com/2015/02/http2-fast-websites.html>) is more secure than the standard HTTP (_Hypertext Transfer Protocol_), then you might be wrong, as it took researchers just four months to discover four flaws in the HTTP/2 protocol. \n \nHTTP/2 was launched properly just in May last year after Google bundled its [SPDY project](<https://www.chromium.org/spdy/spdy-whitepaper>) into HTTP/2 in February in an effort to speed up the loading of web pages as well as the browsing experience of the online users. \n \nNow, security researchers from data center security vendor Imperva today at Black Hat conference [revealed](<http://blog.imperva.com/2016/08/http2-faster-and-better-than-http-11-but-is-it-more-secure.html>) details on at least four high-profile vulnerabilities in HTTP/2 \u2013 a major revision of the HTTP network protocol that the today\u2019s web is based on. \n\n\n \nThe vulnerabilities allow attackers to slow web servers by flooding them with innocent looking messages that carry a payload of gigabytes of data, putting the servers into infinite loops and even causing them to crash. \n \nThe HTTP/2 protocol can be divided into three layers: \n\n\n[](<https://1.bp.blogspot.com/-NpKvVUeReZ4/V6JG0qjkV_I/AAAAAAAApCM/1GYtUbyd8icPAcWxmRcqEtqahoo1Md_BgCLcB/s728-e100/http2-nginx-working.png>)\n\n \n \n\n\n * The transmission layer that includes streams, frames and flow control\n * The HPACK binary encoding and compression protocol\n * The semantic layer \u2013 an enhanced version of HTTP/1.1 enriched with server-push capabilities.\n \nThe researchers took an in-depth look at HTTP/2 server implementations from Apache, Microsoft, NGINX, Jetty, and nghttp2 and discovered exploitable flaws in all major HTTP/2 implementations, including two that are similar to well-known and widely exploited bugs in HTTP/1.x. \n \n\n\n### The four key vulnerabilities found in HTTP/2 include:\n\n \n\n\n#### 1\\. Slow Read (CVE-2016-1546)\n\n[](<https://1.bp.blogspot.com/-xPtRvSYoQRA/V6JHp4FfFZI/AAAAAAAApCc/5WtHZDfB4b0E7WxnVp0gBUBhzfJfCAHxgCLcB/s728-e100/http2-nginx-security.png>)\n\nThis attack is identical to the well-known Slowloris DDoS (distributed denial-of-service) attack that major credit card processors experienced in 2010. The Slow Read attack calls on a malicious client to read responses very slowly. \n \nThe Slow Read attacks were well-studied in the HTTP/1.x ecosystem and they are still alive in the application layer of HTTP/2 implementations. \n\n\n> \"The Imperva Defence Centre identified variants of this vulnerability across most popular web servers, including Apache, IIS, Jetty, NGINX and nghttp2,\" says Imperva.\n\n \n\n\n#### 2\\. HPACK Bomb (CVE-2016-1544, CVE-2016-2525)\n\n[](<https://1.bp.blogspot.com/-uJmDBCrXR5k/V6JHXc91RjI/AAAAAAAApCU/PjiGdFuRnE8-s0uRyFkLPOjIdqw-BcfEwCLcB/s728-e100/http2-nginx.png>)\n\nHPACK Bomb is a compression layer attack that resembles a zip bomb attack or a 'decompression bomb'. \n \nHPACK is used to reduce the size of packet headers. Basically, the sender can tell the receiver the maximum size of the header compression table used to decode the headers. \n\n\n \nIn this attack, a potential hacker creates small and innocent-looking messages that actually unpack into gigabytes of data on the server, thereby consuming all the server memory resources and effectively slowing down or crashing targeted systems. \n \nImperva created a header that was 4KB size -- the same size as the entire compression table. Then on the same connection, it opened up new streams with each stream that referred to the initial header as many times as possible (up to 16K of header references). \n \nAfter sending 14 such streams, the connection consumed 896MB of server memory after decompression, which crashed the server, Imperva researchers explain. \n \n\n\n#### 3\\. Dependency Cycle Attack (CVE-2015-8659)\n\n[](<https://1.bp.blogspot.com/-ZsQ_1U6kd_o/V6JIXh6xr2I/AAAAAAAApCk/i8B9EVo9zGUY_SQdg1cYvhbOrYhU_Xc5QCLcB/s728-e100/http2-security.png>)\n\nThis attack leverages the flow control mechanisms that HTTP/2 uses for network optimization. \n \nA bad intent client can use specially crafted requests to prompt a dependency cycle, thus forcing the server into an infinite loop. \n \nThe flaw could allow an attacker to cause _Denial of Service (DoS)_ or even run arbitrary code on a vulnerable system. \n \n\n\n#### 4\\. Stream Multiplexing Abuse (CVE-2016-0150)\n\n[](<https://1.bp.blogspot.com/-c1jx52aV518/V6JI0mtvQOI/AAAAAAAApCw/6-dFKquQGVQUm69QJsa1t9sVWVj5TJ4sACLcB/s728-e100/Stream-Multiplexing-Abuse.png>)\n\nThe attack allows an attacker to exploit vulnerabilities in the way servers implement the stream multiplexing functionality in order to crash the server. This attack eventually results in a denial of service (DoS) to legitimate users. \n \nAll the four vulnerabilities have already been fixed in HTTP/2, which is currently being used by some 85 Million websites, or around 9 percent of all websites, on the Internet, according to W3Techs. \n \nHere's what Imperva co-founder and chief technology officer Amichai Shulman says: \n\n\n> \"The general web performance improvements and specific enhancements for mobile applications introduced in HTTP/2 are a potential boon for internet users. However, releasing a large amount of new code into the wild in a short time creates an excellent opportunity for attackers.\" \n\n> \"While it is disturbing to see known HTTP 1.x threats introduced in HTTP/2, it\u2019s hardly surprising. As with all new technology, it is important for businesses to perform due diligence and implement safeguards to harden the extended attack surface and protect critical business and consumer data from ever-evolving cyber threats.\"\n\nThe vulnerabilities took advantage of HTTP/2 features that were meant to reduce bandwidth use and round trips while speeding up the loading time of websites. \n \nAccording to Imperva researchers, by implementing a web application firewall (WAF) with virtual patching capabilities can help enterprises to prevent their critical data and applications from cyber attack while introducing HTTP/2. \n \nYou can get more details of Imperva\u2019s research in a report [[PDF](<http://www.imperva.com/docs/Imperva_HII_HTTP2.pdf>)] dubbed \"_HTTP/2: In-depth analysis of the top four flaws of the next generation web protocol_.\"\n", "reporter": "The Hacker News", "published": "2016-08-03T20:10:00", "type": "thn", "title": "4 Flaws hit HTTP/2 Protocol that could allow Hackers to Disrupt Servers", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "bulletinFamily": "info", "cvelist": ["CVE-2015-8659", "CVE-2016-0150", "CVE-2016-1544", "CVE-2016-1546", "CVE-2016-2525"], "_object_type": "robots.models.thn.ThnBulletin", "modified": "2018-07-15T06:21:01", "id": "THN:35D65655AF3E2530CD06D90BAC7FBED8", "href": "https://thehackernews.com/2016/08/http2-protocol-security.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}
