macOS 27.x < 27.2 Multiple Vulnerabilities (149521)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(372122);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/26");

  script_cve_id(
    "CVE-2022-26704",
    "CVE-2026-112410",
    "CVE-2026-112413",
    "CVE-2026-112414",
    "CVE-2026-112415",
    "CVE-2026-112416",
    "CVE-2026-112421",
    "CVE-2026-112423",
    "CVE-2026-112424",
    "CVE-2026-112425",
    "CVE-2026-112427",
    "CVE-2026-112428",
    "CVE-2026-112429",
    "CVE-2026-112430",
    "CVE-2026-112432",
    "CVE-2026-112434",
    "CVE-2026-112437",
    "CVE-2026-112438",
    "CVE-2026-112441",
    "CVE-2026-112442",
    "CVE-2026-112443",
    "CVE-2026-112444",
    "CVE-2026-112446",
    "CVE-2026-112447",
    "CVE-2026-112449",
    "CVE-2026-112451",
    "CVE-2026-112453",
    "CVE-2026-112454",
    "CVE-2026-112455",
    "CVE-2026-112456",
    "CVE-2026-112457",
    "CVE-2026-112459",
    "CVE-2026-112461",
    "CVE-2026-112462",
    "CVE-2026-112464",
    "CVE-2026-112466",
    "CVE-2026-112467",
    "CVE-2026-112468",
    "CVE-2026-112469",
    "CVE-2026-112470",
    "CVE-2026-112471",
    "CVE-2026-112473",
    "CVE-2026-112474",
    "CVE-2026-112475",
    "CVE-2026-112476",
    "CVE-2026-112477",
    "CVE-2026-112478",
    "CVE-2026-112479",
    "CVE-2026-112480",
    "CVE-2026-112481",
    "CVE-2026-112482",
    "CVE-2026-112483",
    "CVE-2026-112484",
    "CVE-2026-112485",
    "CVE-2026-112486",
    "CVE-2026-112487",
    "CVE-2026-112488",
    "CVE-2026-112491",
    "CVE-2026-112492",
    "CVE-2026-112493",
    "CVE-2026-112494",
    "CVE-2026-112495",
    "CVE-2026-112497",
    "CVE-2026-112498",
    "CVE-2026-112500",
    "CVE-2026-112501",
    "CVE-2026-112502",
    "CVE-2026-112504",
    "CVE-2026-112505",
    "CVE-2026-112506",
    "CVE-2026-112508",
    "CVE-2026-112510",
    "CVE-2026-112511",
    "CVE-2026-112512",
    "CVE-2026-112513",
    "CVE-2026-112514",
    "CVE-2026-112515",
    "CVE-2026-112516",
    "CVE-2026-112517",
    "CVE-2026-112518",
    "CVE-2026-112519",
    "CVE-2026-112521",
    "CVE-2026-112522",
    "CVE-2026-112523",
    "CVE-2026-112524",
    "CVE-2026-112525",
    "CVE-2026-112526",
    "CVE-2026-112529",
    "CVE-2026-112530",
    "CVE-2026-112531",
    "CVE-2026-112532",
    "CVE-2026-112533",
    "CVE-2026-112534",
    "CVE-2026-112535",
    "CVE-2026-112536",
    "CVE-2026-112537",
    "CVE-2026-112539",
    "CVE-2026-112540",
    "CVE-2026-112541",
    "CVE-2026-112542",
    "CVE-2026-112543",
    "CVE-2026-112544",
    "CVE-2026-112545",
    "CVE-2026-112546",
    "CVE-2026-112548",
    "CVE-2026-112550",
    "CVE-2026-112551",
    "CVE-2026-112552",
    "CVE-2026-112553",
    "CVE-2026-112554",
    "CVE-2026-112555",
    "CVE-2026-112556",
    "CVE-2026-112557",
    "CVE-2026-112558",
    "CVE-2026-112559",
    "CVE-2026-112561",
    "CVE-2026-112562",
    "CVE-2026-112563",
    "CVE-2026-112565",
    "CVE-2026-112566",
    "CVE-2026-112567",
    "CVE-2026-112568",
    "CVE-2026-112569",
    "CVE-2026-112570",
    "CVE-2026-112571",
    "CVE-2026-112575",
    "CVE-2026-112576",
    "CVE-2026-112577",
    "CVE-2026-112595",
    "CVE-2026-112596",
    "CVE-2026-112599",
    "CVE-2026-112604",
    "CVE-2026-112606",
    "CVE-2026-112607",
    "CVE-2026-112614",
    "CVE-2026-112615",
    "CVE-2026-112616",
    "CVE-2026-112617",
    "CVE-2026-112619",
    "CVE-2026-112620",
    "CVE-2026-112621",
    "CVE-2026-112622",
    "CVE-2026-112623",
    "CVE-2026-112624",
    "CVE-2026-112625",
    "CVE-2026-112626",
    "CVE-2026-112627",
    "CVE-2026-112628",
    "CVE-2026-112629",
    "CVE-2026-112630",
    "CVE-2026-112632",
    "CVE-2026-112633",
    "CVE-2026-112634",
    "CVE-2026-112637",
    "CVE-2026-112638",
    "CVE-2026-112639",
    "CVE-2026-112640",
    "CVE-2026-112642",
    "CVE-2026-112647",
    "CVE-2026-112651",
    "CVE-2026-112652",
    "CVE-2026-112653",
    "CVE-2026-112654",
    "CVE-2026-112655",
    "CVE-2026-112656",
    "CVE-2026-112658",
    "CVE-2026-112659",
    "CVE-2026-112660",
    "CVE-2026-112665",
    "CVE-2026-112666",
    "CVE-2026-112668",
    "CVE-2026-112669",
    "CVE-2026-112670",
    "CVE-2026-112671",
    "CVE-2026-112672",
    "CVE-2026-112673",
    "CVE-2026-112675",
    "CVE-2026-112676",
    "CVE-2026-112677",
    "CVE-2026-112678",
    "CVE-2026-112679",
    "CVE-2026-112680",
    "CVE-2026-112682",
    "CVE-2026-112683",
    "CVE-2026-112684",
    "CVE-2026-112685",
    "CVE-2026-112686",
    "CVE-2026-112688",
    "CVE-2026-112689",
    "CVE-2026-112690",
    "CVE-2026-112693",
    "CVE-2026-112695",
    "CVE-2026-112696",
    "CVE-2026-112697",
    "CVE-2026-112698",
    "CVE-2026-112699",
    "CVE-2026-112704",
    "CVE-2026-112705",
    "CVE-2026-112708",
    "CVE-2026-113896",
    "CVE-2026-113897",
    "CVE-2026-113898",
    "CVE-2026-113899",
    "CVE-2026-113900",
    "CVE-2026-113901",
    "CVE-2026-113903",
    "CVE-2026-113904",
    "CVE-2026-113907",
    "CVE-2026-113909",
    "CVE-2026-113910",
    "CVE-2026-113912",
    "CVE-2026-113913",
    "CVE-2026-113915",
    "CVE-2026-113934",
    "CVE-2026-113935",
    "CVE-2026-113936",
    "CVE-2026-113937",
    "CVE-2026-113938",
    "CVE-2026-113939",
    "CVE-2026-113940",
    "CVE-2026-113941",
    "CVE-2026-113942",
    "CVE-2026-113943",
    "CVE-2026-113944",
    "CVE-2026-113945",
    "CVE-2026-113946",
    "CVE-2026-113947",
    "CVE-2026-113948",
    "CVE-2026-113949",
    "CVE-2026-113950",
    "CVE-2026-113952",
    "CVE-2026-65327",
    "CVE-2026-65350",
    "CVE-2026-65384",
    "CVE-2026-65397",
    "CVE-2026-84494",
    "CVE-2026-84495",
    "CVE-2026-84496",
    "CVE-2026-84590",
    "CVE-2026-86896",
    "CVE-2026-86925",
    "CVE-2026-86936",
    "CVE-2026-86937",
    "CVE-2026-86939",
    "CVE-2026-86941",
    "CVE-2026-86943",
    "CVE-2026-86945",
    "CVE-2026-86946",
    "CVE-2026-86968",
    "CVE-2026-86969",
    "CVE-2026-86970",
    "CVE-2026-86971",
    "CVE-2026-86972",
    "CVE-2026-86973",
    "CVE-2026-86974",
    "CVE-2026-86978",
    "CVE-2026-86984",
    "CVE-2026-86985",
    "CVE-2026-86986",
    "CVE-2026-86988",
    "CVE-2026-86990",
    "CVE-2026-86991",
    "CVE-2026-86992"
  );
  script_xref(name:"APPLE-SA", value:"149521");

  script_name(english:"macOS 27.x < 27.2 Multiple Vulnerabilities (149521)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a macOS update that fixes multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The remote host is running a version of macOS / Mac OS X that is 27.x prior to 27.2. It is, therefore, affected by
multiple vulnerabilities:

  - A validation issue existed in the handling of symlinks and was addressed with improved validation of
    symlinks. This issue is fixed in macOS Monterey 12.4. An app may be able to gain elevated privileges.
    (CVE-2022-26704)

  - An out-of-bounds read was addressed with improved bounds checking. (CVE-2026-112413, CVE-2026-112414,
    CVE-2026-112415, CVE-2026-112416, CVE-2026-112423, CVE-2026-112425, CVE-2026-112449, CVE-2026-112455,
    CVE-2026-112456, CVE-2026-112461, CVE-2026-112464, CVE-2026-112466, CVE-2026-112468, CVE-2026-112469,
    CVE-2026-112470, CVE-2026-112476, CVE-2026-112477, CVE-2026-112479, CVE-2026-112486, CVE-2026-112488,
    CVE-2026-112491, CVE-2026-112501, CVE-2026-112514, CVE-2026-112515, CVE-2026-112516, CVE-2026-112517,
    CVE-2026-112522, CVE-2026-112546, CVE-2026-112554, CVE-2026-112559, CVE-2026-112561, CVE-2026-112566,
    CVE-2026-112571, CVE-2026-112576, CVE-2026-112606, CVE-2026-112614, CVE-2026-112615, CVE-2026-112621,
    CVE-2026-112622, CVE-2026-112623, CVE-2026-112624, CVE-2026-112625, CVE-2026-112626, CVE-2026-112627,
    CVE-2026-112628, CVE-2026-112629, CVE-2026-112630, CVE-2026-112632, CVE-2026-112633, CVE-2026-112634,
    CVE-2026-112638, CVE-2026-112639, CVE-2026-112640, CVE-2026-112642, CVE-2026-112651, CVE-2026-112652,
    CVE-2026-112653, CVE-2026-112654, CVE-2026-112655, CVE-2026-112656, CVE-2026-112659, CVE-2026-112660,
    CVE-2026-112665, CVE-2026-112671, CVE-2026-112673, CVE-2026-112676, CVE-2026-112678, CVE-2026-112680,
    CVE-2026-112682, CVE-2026-112683, CVE-2026-112684, CVE-2026-112686, CVE-2026-112689, CVE-2026-112690,
    CVE-2026-112693, CVE-2026-112695, CVE-2026-112697, CVE-2026-112698, CVE-2026-112699, CVE-2026-112705,
    CVE-2026-113896, CVE-2026-113898, CVE-2026-113904, CVE-2026-113907, CVE-2026-113909, CVE-2026-113910,
    CVE-2026-113913, CVE-2026-113915, CVE-2026-113949, CVE-2026-113952, CVE-2026-65350, CVE-2026-65397,
    CVE-2026-84495, CVE-2026-86969, CVE-2026-86970, CVE-2026-86971, CVE-2026-86972, CVE-2026-86973,
    CVE-2026-86974, CVE-2026-86985, CVE-2026-86986, CVE-2026-86991, CVE-2026-86992)

  - A denial-of-service issue was addressed with improved input validation. (CVE-2026-112432, CVE-2026-112446,
    CVE-2026-112454, CVE-2026-112459, CVE-2026-112474, CVE-2026-112485, CVE-2026-112500, CVE-2026-112518,
    CVE-2026-112565, CVE-2026-112567, CVE-2026-112595, CVE-2026-112596, CVE-2026-112599, CVE-2026-112607,
    CVE-2026-112616, CVE-2026-112619, CVE-2026-112620, CVE-2026-112637, CVE-2026-112658, CVE-2026-112666,
    CVE-2026-112669, CVE-2026-112679, CVE-2026-112685, CVE-2026-112688, CVE-2026-112696, CVE-2026-113897,
    CVE-2026-113901, CVE-2026-113903, CVE-2026-113912, CVE-2026-113950, CVE-2026-84494, CVE-2026-86925,
    CVE-2026-86968, CVE-2026-86978, CVE-2026-86988)

  - A validation issue was addressed with improved input sanitization. (CVE-2026-112563)

  - An access issue was addressed with improved access restrictions. (CVE-2026-86990)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported
version number.");
  script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/149521");
  script_set_attribute(attribute:"solution", value:
"Upgrade to macOS 27.2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-26704");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/05/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x:27.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:macos:27.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_ports("Host/MacOSX/Version", "Host/local_checks_enabled", "Host/MacOSX/packages/boms");

  exit(0);
}

include('vcf.inc');
include('vcf_extras_apple.inc');

var app_info = vcf::apple::macos::get_app_info();

var constraints = [
  { 'fixed_version' : '27.2.0', 'min_version' : '27.0', 'fixed_display' : 'macOS Golden Gate 27.2' }
];

vcf::apple::macos::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);