Mac OS X : Java for Mac OS X 10.6 Update 2

#TRUSTED 2bb19c1dcf36b59e563bf0d50b813aadaee9d7ce0388177dc2e56d627b2fce361e42bcfab3e4504e96ceba307e27fa3fc5c643d55a24105c48ea6655c04d56c336ae7f0d09bb733d0e0cf652898a60e8a4f2695927864ab6b25ad7bc793d326932c0c31f0d753167140598a9fac59a28ec17f3381488ee7bede5abfa1aa353dea08de1fbeb9a7440aebb842d0caebd33baa7b5a5758c29ef95d76eb44d79c2d0c83ecc7c5bb792034b9f81789b871cc8675edb5b53556374060dc0d6ca466bc2544011fa2316c997aebbd80d0fe609f4a0c9aaa24775c0c7304a6bd35cd999d8f3cf64a1ccbcb5a9059584c46343a8ac2f1bde8fea569d97077a87672554c1bf90ffb7dc519d85d684f373072e790889c7937fc37a4c3a86c2c429d5adf655686eb8587d900f3406ce0142597cf7a0b93cbfa0876123bfd4cb3b88b7ec92f796e0245d92b94c901d6d4bd5581e6f3ed202954ed00c7d0932bfe9834cb971d9c1d09c6583ec81ff2672083c7515f0192fd91499582ea248d702a5488bf0e659dcf9973f602dc84c2440d7e698a017c2a2d47d8ac5fdf36a58755a82548dcd5331bc015bd96d9a8a534280cb3e1a20f3146b724eb611944249fe3fcd9a7916836e9223ec8d02b0d1e4825e87b83ab3753b95392e478c0d2fd6f9946bd47426faf19eaddbf9e145580897f24f51ec43978bfec5f8af5d654c25251f217d1c43984c
#TRUST-RSA-SHA256 078f188d9ef2866e30348a1b99e33e887ae8d39e80256148692bfd6f689815890c6587f18b3525fd529704185c28a5dc0f526539a4df8ae30480195f6872aebed7b7250f6cf4e1f3d2ed27dd8d97b6609227f811fe7e78269fe37d2f81fd92af83dfe62ab7808ee9a50652c07b3f8ae493192c7cb47df932decbfdeeb6ed7ef037dfb720f18402ca0d9d919413cacf45c046958ee442a1b2e2525cef8c629cbd80b206061b8e4585e5c4f649b24faf7226ab0e26394b61b12a9bbcf3e26f025fdc89e6b9557c37ed9c5a0e18618f40467b1c06c55e733dd43ce0f6333ae250c0472df082e2d69bae449ead6976a14309cd69df3bbdbaea5bd13a9c6d7df9129dba4de05f877635927f784585c6a1f1cc8a0594029aae85edf418b844017959415af2fe4271a5a88126bd97eec2245a65e46574aea07a9aa1e0453ca585f4384b6a738d43e925ada40a107274dd165f32417249d9b19507ab448da453c8cb4a7239e69638529a26c3ba1deea10f5904129c8e27f370b31ceee61debaa073507ff288ffb037dc805608cb4d493042b1aeff459960805fedf7a856b921cc5142dd6a57853c582151b1a30ffdea24a3203240fa71d1942e6c7c16a6c40817b30ea6279ed896f909c39a59ee616dbb4a7d1e0bc5ddec4f6bc4ea250048ae6b6706c7c10c6302cbd29e5ed9eb58dbd0dad70aceeedd5f5bddf1f378770ed9514bfd630
#
# (C) Tenable Network Security, Inc.
#

include('compat.inc');

if (description)
{
  script_id(46674);
  script_version("1.25");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/11/27");

  script_cve_id(
    "CVE-2009-1105",
    "CVE-2009-3555",
    "CVE-2009-3910",
    "CVE-2010-0082",
    "CVE-2010-0084",
    "CVE-2010-0085",
    "CVE-2010-0087",
    "CVE-2010-0088",
    "CVE-2010-0089",
    "CVE-2010-0090",
    "CVE-2010-0091",
    "CVE-2010-0092",
    "CVE-2010-0093",
    "CVE-2010-0094",
    "CVE-2010-0095",
    "CVE-2010-0538",
    "CVE-2010-0539",
    "CVE-2010-0837",
    "CVE-2010-0838",
    "CVE-2010-0840",
    "CVE-2010-0841",
    "CVE-2010-0842",
    "CVE-2010-0843",
    "CVE-2010-0844",
    "CVE-2010-0846",
    "CVE-2010-0847",
    "CVE-2010-0848",
    "CVE-2010-0849",
    "CVE-2010-0886",
    "CVE-2010-0887"
  );
  script_bugtraq_id(
    34240,
    36935,
    39069,
    39073,
    39078,
    39492,
    40238,
    40240
  );
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2022/06/15");

  script_name(english:"Mac OS X : Java for Mac OS X 10.6 Update 2");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has a version of Java that is affected by multiple
vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote Mac OS X host is running a version of Java for Mac OS X
10.6 that is missing Update 2.

The remote version of this software contains several security
vulnerabilities, including some that may allow untrusted Java applets
to obtain elevated privileges and lead to execution of arbitrary code
with the privileges of the current user.");
  script_set_attribute(attribute:"see_also", value:"http://support.apple.com/kb/HT4171");
  script_set_attribute(attribute:"see_also", value:"http://lists.apple.com/archives/security-announce/2010/May/msg00001.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Java for Mac OS X 10.6 Update 2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2010-0887");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Sun Java Web Start Plugin Command Line Argument Injection');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:"CANVAS");
  script_cwe_id(310);

  script_set_attribute(attribute:"vuln_publication_date", value:"2010/05/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2010/05/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/05/19");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2010-2023 Tenable Network Security, Inc.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/MacOSX/packages");

  exit(0);
}


include("misc_func.inc");
include("ssh_func.inc");
include("macosx_func.inc");



enable_ssh_wrappers();

function exec(cmd)
{
  local_var ret, buf;

  if (islocalhost())
    buf = pread_wrapper(cmd:"/bin/bash", argv:make_list("bash", "-c", cmd));
  else
  {
    ret = ssh_open_connection();
    if (!ret) exit(1, "ssh_open_connection() failed.");
    buf = ssh_cmd(cmd:cmd);
    ssh_close_connection();
  }
  if (buf !~ "^[0-9]") exit(1, "Failed to get the version - '"+buf+"'.");

  buf = chomp(buf);
  return buf;
}


packages = get_kb_item("Host/MacOSX/packages");
if (!packages) exit(1, "The 'Host/MacOSX/packages' KB item is missing.");

uname = get_kb_item("Host/uname");
if (!uname) exit(1, "The 'Host/uname' KB item is missing.");

# Mac OS X 10.6 only.
if (!egrep(pattern:"Darwin.* 10\.", string:uname)) exit(0, "The remote Mac is not running Mac OS X 10.6 and thus is not affected.");

plist = "/System/Library/Frameworks/JavaVM.framework/Versions/A/Resources/version.plist";
cmd =
  'cat ' + plist + ' | ' +
  'grep -A 1 CFBundleVersion | ' +
  'tail -n 1 | ' +
  'sed \'s/.*string>\\(.*\\)<\\/string>.*/\\1/g\'';
version = exec(cmd:cmd);
if (!strlen(version)) exit(1, "Can't get version info from '"+plist+"'.");

ver = split(version, sep:'.', keep:FALSE);
for (i=0; i<max_index(ver); i++)
  ver[i] = int(ver[i]);

# Fixed in version 13.2.0.
if (
  ver[0] < 13 ||
  (ver[0] == 13 && ver[1] < 2)
)
{
  gs_opt = get_kb_item("global_settings/report_verbosity");
  if (gs_opt && gs_opt != 'Quiet')
  {
    report =
      '\n  Installed version : ' + version +
      '\n  Fixed version     : 13.2.0\n';
    security_hole(port:0, extra:report);
  }
  else security_hole(0);
}
else exit(0, "The remote host is not affected since JavaVM Framework version "+version+" is installed.");