The version of Safari installed on the remote Windows host is earlier than 3.2.2.  Such versions reportedly have multiple vulnerabilities : 

  - Multiple input validation issues in their handling of 'feed: ' URLs, which could be abused to execute arbitrary JavaScript code in the local security zone. (CVE-2009-0137)

  - A cached certificate is not required before displaying a lock icon for a HTTPS web site. This allows a man-in-the-middle attacker to present the user with spoofed web pages over HTTPS that appear to be from a legitimate source. (CVE-2009-2072)

  - The browser processes a 3xxx HTTP CONNECT before a successful SSL handshake, which could allow a man-in-the-midddle attacker to execute arbitrary script code in the context of a HTTPS site. (CVE-2009-2062)

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-001 applied.

This security update contains fixes for the following products :

  - AFP Server
  - Apple Pixlet Video
  - CarbonCore
  - CFNetwork
  - Certificate Assistant
  - ClamAV
  - CoreText
  - CUPS
  - DS Tools
  - fetchmail
  - Folder Manager
  - FSEvents
  - Network Time
  - perl
  - Printing
  - python
  - Remote Apple Events
  - Safari RSS
  - servermgrd
  - SMB
  - SquirrelMail
  - X11
  - XTerm

The version of Safari installed on the remote Windows host is earlier than 3.2.2.  Such versions reportedly have multiple security vulnerabilities :

  - Input validation issues in their handling of 'feed:'     URLs, which could be abused to execute arbitrary     JavaScript code in the local security zone.

  - A cached certificate is not required before displaying     a lock icon for a HTTPS website.  This allows a man-     in-the-middle attacker to present the user with spoofed     web pages over HTTPS that appear to be from a legitimate     source.

  - The browser processes a 3xx HTTP CONNECT before a     successful SSL handshake, which could allow a man-in-     the-middle attacker to execute arbitrary script code in     the context of a HTTPS site.

ID	名稱	產品	系列	已發布	已更新	嚴重性
4932	Safari < 3.2.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2009/2/16	2019/3/6	high
35684	Mac OS X Multiple Vulnerabilities (Security Update 2009-001)	Nessus	MacOS X Local Security Checks	2009/2/13	2024/5/28	critical
35687	Safari < 3.2.2 Multiple Vulnerabilities	Nessus	Windows	2009/2/13	2018/11/15	high

偵測

搜尋 Plugin

high

critical

high