The remote Mac OS X host is running a version of Java for Mac OS X 10.5 that is missing Update 6.
The remote version of this software contains several security vulnerabilities, including some that may allow untrusted Java applets to obtain elevated privileges and lead to execution of arbitrary code with the privileges of the current user.
#TRUSTED 998bc78e7d646e551e51651ab01dbfc1809da53b4b9e25cb54d4cd52a69e866c164cc6323415732b77cd8f853d7285d2a191bdfa7cbc0e46e4fc493ccafc8d82e18f13f0061bd9cbf98188551cb13b5c93b5eca1b7d685ccc4756389c38705b57d5fda904d74da1719eefba883d47feb38e98ae32494a1b0990b26dcaa56b4044f2907e60ef8bd9448c415ebc3b31b7e87d658f6eca69007a442fe76eeed742620ad671ff14f49fceb5a8b185dff354c1c78a5183954cbea852ebe1945bc5a12be162b3dcfe16df8ce253c332d507fc51042ae863a3a6bce8f3f98dfab10fe9b1956b3f34827fdb406868051c76cfe60b5634d42cbaaef550337d58a37e965c992f9dca9624d41d88d10030e1fac9d7779fd62b67c3d0aa26545698672f37001b367905d1d2924f6b5246a804d79ec4b7cb9309fdc9f3fa887e7bf465189d27a94aecd469b4b18619fd579d50a5c543603b4b060ea86cbe089004177bd3bc97f6104c696fa1720bc5f673f1b6f0276cf7633bd6d2be888e20952cf971d47077cd047a6eb872b75c450b69c8b7d720d8ec6fd92501922c943518a36777b38ab064a23c2e8c8c3e6a9fddae3b82c816d1c1350702d1d9f0fd031c8524a6b1a5a3ae1ea314bca026b4e1334363b185a45b39c0200ffadc6b5977fb201677cb564be82792a0ab3f5600d46193dbdd876689502e079cdc109c48a5bcccfbb29dbe804
#TRUST-RSA-SHA256 70939d01ee06e61545396dc53e488f0372398ea3e7a0f2b5534264c8058743576c603718f6724d41cf6f125d497bd2acc6c06f5134ad770082c702bfda934d95dd2fc8c35054330cd428d7eaea2720045bd2dc9315a02469a0cb6b9fb246f857b7b4a49292440330c11f2db4b5e0893e4a045c5cd87ce14dc53bbb0107d6537ea0e696c58a58e9af4497c30d13967de572e7f16bc71f6142e3105cd6dea4e38f7db3b32870cf42fed45964373a604aeafcc39a7e9b2d7438d2a75ecf44086661f36184f079c6e0bc16aa9de3a81315e0f37569727f000b4a40d8332998228d426d71be33fb0ca3b3d4236f222853c08b3feb5e90216ffc9a7f64ad9f7b7643b34793a8e463cdca548ea0c45d7f305b2e6f08f9c711d2b082c9e100dd9c1fd3469599ca69f57bbbce4b634095fb9e0c25ecce9e469f576cbde59ff164b0c10cecc433867534bf17e1f23a3b723c7be4e8b7e79f613989c62f2acc8cf3df7b9b8ef46d99358135c03787d459dbc8b7ced27c396fb86cfa4196913063387325c571c7e7da1362b07e6147b0ffa450847dcc0b196df1bad9ee4cf82ac0468401625f380dc9008714d776be3c6a7da3c4ce5fe4f360be826b45da1207f848ec4aae304c1cf07325a9c57db033047027b36f4593c8ecc64c84475244eedf5a7dfa2ad732c994f97f8fc644924a0655e284d03de517f2371fcf35de92d0f6403c5c7452
#
# (C) Tenable Network Security, Inc.
#
include("compat.inc");
if (description)
{
script_id(43002);
script_version("1.22");
script_set_attribute(attribute:"plugin_modification_date", value:"2023/11/27");
script_cve_id(
"CVE-2009-2843",
"CVE-2009-3728",
"CVE-2009-3865",
"CVE-2009-3866",
"CVE-2009-3867",
"CVE-2009-3868",
"CVE-2009-3869",
"CVE-2009-3871",
"CVE-2009-3872",
"CVE-2009-3873",
"CVE-2009-3874",
"CVE-2009-3875",
"CVE-2009-3877",
"CVE-2009-3884"
);
script_bugtraq_id(36881, 37206);
script_name(english:"Mac OS X : Java for Mac OS X 10.5 Update 6");
script_summary(english:"Checks version of the JavaVM framework");
script_set_attribute(
attribute:"synopsis",
value:
"The remote host has a version of Java that is affected by multiple
vulnerabilities."
);
script_set_attribute(
attribute:"description",
value:
"The remote Mac OS X host is running a version of Java for Mac OS X
10.5 that is missing Update 6.
The remote version of this software contains several security
vulnerabilities, including some that may allow untrusted Java applets
to obtain elevated privileges and lead to execution of arbitrary code
with the privileges of the current user."
);
script_set_attribute(
attribute:"see_also",
value:"http://support.apple.com/kb/HT3970"
);
script_set_attribute(
attribute:"see_also",
value:"http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html"
);
script_set_attribute(
attribute:"see_also",
value:"http://www.securityfocus.com/advisories/18433"
);
script_set_attribute(
attribute:"solution",
value:"Upgrade to Java for Mac OS X 10.5 Update 6 or later."
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2009-3874");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"exploit_framework_core", value:"true");
script_set_attribute(attribute:"exploited_by_malware", value:"true");
script_set_attribute(attribute:"metasploit_name", value:'Sun Java JRE AWT setDiffICM Buffer Overflow');
script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
script_set_attribute(attribute:"canvas_package", value:'CANVAS');
script_cwe_id(310);
script_set_attribute(attribute:"vuln_publication_date", value:"2009/12/03");
script_set_attribute(attribute:"patch_publication_date", value:"2009/12/03");
script_set_attribute(attribute:"plugin_publication_date", value:"2009/12/04");
script_set_attribute(attribute:"plugin_type", value:"local");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"MacOS X Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2009-2023 Tenable Network Security, Inc.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/MacOSX/packages");
exit(0);
}
include("misc_func.inc");
include("ssh_func.inc");
include("macosx_func.inc");
enable_ssh_wrappers();
function exec(cmd)
{
local_var ret, buf;
if (islocalhost())
buf = pread_wrapper(cmd:"/bin/bash", argv:make_list("bash", "-c", cmd));
else
{
ret = ssh_open_connection();
if (!ret) exit(1, "ssh_open_connection() failed.");
buf = ssh_cmd(cmd:cmd);
ssh_close_connection();
}
if (buf !~ "^[0-9]") exit(1, "Failed to get the version - '"+buf+"'.");
buf = chomp(buf);
return buf;
}
packages = get_kb_item("Host/MacOSX/packages");
if (!packages) exit(1, "The 'Host/MacOSX/packages' KB item is missing.");
uname = get_kb_item("Host/uname");
if (!uname) exit(1, "The 'Host/uname' KB item is missing.");
# Mac OS X 10.5 only.
if (!egrep(pattern:"Darwin.* 9\.", string:uname)) exit(0, "The remote Mac is not running Mac OS X 10.5 and thus is not affected.");
plist = "/System/Library/Frameworks/JavaVM.framework/Versions/A/Resources/version.plist";
cmd = string(
"cat ", plist, " | ",
"grep -A 1 CFBundleVersion | ",
"tail -n 1 | ",
'sed \'s/.*string>\\(.*\\)<\\/string>.*/\\1/g\''
);
version = exec(cmd:cmd);
if (!strlen(version)) exit(1, "Can't get version info from '"+plist+"'.");
ver = split(version, sep:'.', keep:FALSE);
for (i=0; i<max_index(ver); i++)
ver[i] = int(ver[i]);
# Fixed in version 12.5.0.
if (
ver[0] < 12 ||
(ver[0] == 12 && ver[1] < 5)
)
{
gs_opt = get_kb_item("global_settings/report_verbosity");
if (gs_opt && gs_opt != 'Quiet')
{
report =
'\n Installed version : ' + version +
'\n Fixed version : 12.5.0\n';
security_hole(port:0, extra:report);
}
else security_hole(0);
}
else exit(0, "The remote host is not affected since JavaVM Framework version "+version+" is installed.");
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2843
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3728
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3865
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3866
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3867
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3868
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3869
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3871
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3872
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3873
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3874
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3875
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3877
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3884
lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
support.apple.com/kb/HT3970
www.securityfocus.com/advisories/18433