远程 Windows 主机上安装的 Apple iTunes 版本低于 12.0.1。因此，它受到因随附 WebKit 的版本而造成的多种漏洞的影响。这些错误可导致应用程序崩溃或任意代码执行。

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

- 更新到 Chromium 31.0.1650.63 稳定通道更新：

- 安全补丁：

- CVE-2013-6634：同步中与 302 重定向相关的会话固定

- CVE-2013-6635：编辑时的释放后使用

- CVE-2013-6636：与模式对话框相关的地址栏欺骗

- CVE-2013-6637：通过内部审计、模糊测试和其他计划获得的各种补丁。

- CVE-2013-6638：v8 中的缓冲区溢出

- CVE-2013-6639：v8 中的越界写入。

- CVE-2013-6640：v8 中的越界读取

- 和 12 个其他安全补丁。

- 根据 Chrome ffmpeg 品牌和专有编解码器删除内部版本的版本标记。(bnc#847971)

The remote host has Safari installed that is older than 6.1.2 or 7.0.2, which means it is not patched for the following WebKit vulnerabilities :

 - Unspecified memory-corruption vulnerabilities that could be leveraged to execute arbitrary code, or cause denial of service. (CVE-2014-1268, CVE-2014-1269, CVE-2014-1270)
 - Use-after-free error in the 'ReplaceSelectionCommand' file which can be leveraged to execute arbitrary code, or cause denial of service (CVE-2013-6635)

According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS prior to 7.1 are affected by vulnerabilities within the following components :

  - Backup
  - Certificate Trust Policy
  - Configuration Profiles
  - CoreCapture
  - Crash Reporting
  - dyld
  - FaceTime
  - ImageIO
  - IOKit HID Event
  - iTunes Store
  - Kernel
  - Office Viewer
  - Photos Backend
  - Profiles
  - Safari
  - Find My iPhone status
  - Springboard
  - SpringBoard Lock Screen
  - TelephonyUI Framework
  - USB Host
  - Video Driver
  - WebKit

Versions earlier than the Apple TV 6.1 update are vulnerable to multiple issues, the most serious of which could be leveraged to result in arbitrary code execution.

Versions of iTunes earlier than 12.0.1 are missing updates that patch memory corruption vulnerabilities within WebKit, as well as a patch that fixes a man-in-the-middle vulnerability that affects encrypted connections to the iTunes Store via iTunes. The most severe of these vulnerabilites can result in arbitrary remote code execution or unexpected application termination.

The remote host has Google Chrome browser installed. Versions of Google Chrome prior to 31.0.1650.63 are affected by multiple vulnerabilities, some of which include the following:

  - Use-after-free in editing (CVE-2013-6635)

  - Out-of-bounds read/write operations and a buffer overflow vulnerability in the Chrome v8 engine, which have been fixed in version 3.22.24.7, included in the updated version of Chrome (CVE-2013-6638, CVE-2013-6639, CVE-2013-6640)

  - Address bar spoofing that can be triggered via modal dialogs (CVE-2013-6636)

  - Session fixation attack via 302 redirects in one-click sign-in flow and gaia HTTP headers, which can allow a context-dependent attacker to hijack the user session. (CVE-2013-6634)

ID	名稱	產品	系列	已發布	已更新	嚴重性
78597	Apple iTunes < 12.0.1 多种漏洞（凭据检查）	Nessus	Windows	2014/10/21	2018/11/15	critical
74860	openSUSE 安全更新：chromium (openSUSE-SU-2013:1927-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high
8137	Safari < 6.1.2 / 7.0.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2014/2/26	2019/3/6	medium
8155	Apple iOS < 7.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	2014/3/11	2019/3/6	high
8250	Apple TV < 6.1 Multiple Vulnerabilities	Nessus Network Monitor	Internet Services	2014/5/29	2019/3/6	high
8561	iTunes < 12.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2014/10/20	2019/3/6	critical
801613	Google Chrome < 31.0.1650.63 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2013/12/5		medium

偵測

搜尋 Plugin

critical

high

medium

high

high

critical

medium