远程主机正在运行的 Mac OS X 10.6 或 10.7 版本未应用安全更新 2013-002。此更新包含针对以下组件的大量安全相关补丁：

- CoreMedia Playback（仅 10.7）
 - Directory Service（仅 10.6）
 - OpenSSL
 - QuickDraw Manager
 - QuickTime
 - Ruby（仅 10.6）
 - SMB（仅 10.7）

Versions of OpenSSL 0.9.8 earlier than 0.9.8s, and 1.0.0 earlier than 1.0.0f are potentially affected by the following vulnerabilities :

  - An extension of the Vaudenay padding oracle attack exists against CBC mode encryption which enables an efficient plaintext recovery attack against the OpenSSL implementation of DTLS. (CVE-2011-4108)

  - If x509_V_FLAG_POLICY_CHECK is set in OpenSSL 0.9.8, then a policy check failure can lead to a double-free. (CVE-2011-4109)

  - OpenSSL fails to clear the bytes used as block cipher padding in SSL 3.0 records.  As a result, in each record, up to 15 bytes of uninitialized memory may be sent, encrypted, to the SSL peer. (CVE-2011-4576)

  - RFC 3779 data can be included in certificates, and if it is malformed, may trigger an assertion failure.  This could be used in a denial-of-service attack. (CVE-2011-4577)

  - Support for handshake restarts for server gated cryptography (SGC) can be used in a denial-of-service attack. (CVE-2011-4619)

  - A malicious TLS client can send an invalid set of GOST parameters which will cause the server to crash due to a lack of error checking. (CVE-2012-0027)

The remote host is running a version of Mac OS X 10.8 that is older than 10.8.4. The newer version contains numerous security-related fixes :

  - A local security-bypass vulnerability exists that affects the Disk Management component. The issue can be exploited by an unauthorized attacker to disable FileVault using the command-line. (CVE-2013-0985)

  - A security-bypass vulnerability in SMB file sharing can occur whereby an authenticated attacker can write files outside the shared directory. (CVE-2013-0990)

  - A remote buffer-overflow vulnerability exists when handling certain PICT images. (CVE-2013-0975)

  - A security-bypass vulnerability exists whereby an attacker with access to a user's session may be able to log into previously accessed sites. An attacker can exploit this issue even if Private Browsing was used. (CVE-2013-0982)

  - A remote-code execution issue affects the text glyphs because of an unbounded stack allocation when handling maliciously crafted URLs. (CVE-2013-0983)

  - A remote-code execution vulnerability exists due to improper handling of text tracks. (CVE-2013-1024)

  - A buffer-overflow vulnerability exists in the Directory Service daemon that can be exploited via a specially crafted network message. (CVE-2013-0984)

ID	名稱	產品	系列	已發布	已更新	嚴重性
66809	Mac OS X 多种漏洞（安全更新 2013-002）	Nessus	MacOS X Local Security Checks	2013/6/5	2024/5/28	critical
6129	OpenSSL 0.9.8 < 0.9.8s / 1.x < 1.0.0f Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2012/1/5	2019/3/6	high
6857	Mac OS X 10.8 < 10.8.4 Multiple Vulnerabilities (Security Update 2013-002)	Nessus Network Monitor	Web Clients	2013/6/5	2019/3/6	critical
801059	OpenSSL 0.9.8 < 0.9.8s / 1.x < 1.0.0f Multiple Vulnerabilities	Log Correlation Engine	Web Servers	2012/1/5		high
801016	Mac OS X 10.8 < 10.8.4 Multiple Vulnerabilities (Security Update 2013-002)	Log Correlation Engine	Operating System Detection	2013/6/5		high

偵測

搜尋 Plugin

critical

high

critical

high

high