Vulnerabilities > CVE-2015-3750 - 7PK - Security Features vulnerability in Apple Iphone OS and Safari

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(90315);
  script_version("1.12");
  script_cvs_date("Date: 2019/11/19");

  script_cve_id(
    "CVE-2012-6685",
    "CVE-2014-0191",
    "CVE-2014-3660",
    "CVE-2015-3730",
    "CVE-2015-3731",
    "CVE-2015-3732",
    "CVE-2015-3733",
    "CVE-2015-3734",
    "CVE-2015-3735",
    "CVE-2015-3736",
    "CVE-2015-3737",
    "CVE-2015-3738",
    "CVE-2015-3739",
    "CVE-2015-3740",
    "CVE-2015-3741",
    "CVE-2015-3742",
    "CVE-2015-3743",
    "CVE-2015-3744",
    "CVE-2015-3745",
    "CVE-2015-3746",
    "CVE-2015-3747",
    "CVE-2015-3748",
    "CVE-2015-3749",
    "CVE-2015-3750",
    "CVE-2015-3751",
    "CVE-2015-3752",
    "CVE-2015-3753",
    "CVE-2015-3759",
    "CVE-2015-3766",
    "CVE-2015-3768",
    "CVE-2015-3776",
    "CVE-2015-3778",
    "CVE-2015-3782",
    "CVE-2015-3784",
    "CVE-2015-3793",
    "CVE-2015-3795",
    "CVE-2015-3796",
    "CVE-2015-3797",
    "CVE-2015-3798",
    "CVE-2015-3800",
    "CVE-2015-3802",
    "CVE-2015-3803",
    "CVE-2015-3804",
    "CVE-2015-3805",
    "CVE-2015-3806",
    "CVE-2015-3807",
    "CVE-2015-5749",
    "CVE-2015-5755",
    "CVE-2015-5756",
    "CVE-2015-5757",
    "CVE-2015-5758",
    "CVE-2015-5761",
    "CVE-2015-5773",
    "CVE-2015-5774",
    "CVE-2015-5775",
    "CVE-2015-5776",
    "CVE-2015-5777",
    "CVE-2015-5778",
    "CVE-2015-5781",
    "CVE-2015-5782",
    "CVE-2015-7995"
  );
  script_bugtraq_id(
    67233,
    70644,
    76337,
    76338,
    76341,
    76343,
    77325
  );
  script_xref(name:"APPLE-SA", value:"APPLE-SA-2016-02-25-1");

  script_name(english:"Apple TV < 7.2.1 Multiple Vulnerabilities");
  script_summary(english:"Checks the version in the banner.");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its banner, the remote Apple TV device is a version prior
to 7.2.1. It is, therefore, affected by multiple vulnerabilities in
the following components :

  - bootp
  - CFPreferences
  - CloudKit
  - Code Signing
  - CoreMedia Playback
  - CoreText
  - DiskImages
  - FontParser
  - ImageIO
  - IOHIDFamily
  - IOKit
  - Kernel
  - Libc
  - Libinfo
  - libpthread
  - libxml2
  - libxpc
  - libxslt
  - Location Framework
  - Office Viewer
  - QL Office
  - Sandbox_profiles
  - WebKit");
  script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT205795");
  # https://lists.apple.com/archives/security-announce/2016/Feb/msg00000.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d959a1e0");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apple TV version 7.2.1 or later. Note that this update is
only available for 3rd generation models.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-5757");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/02/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/02/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/04/04");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apple:apple_tv");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("appletv_version.nasl");
  script_require_keys("AppleTV/Version", "AppleTV/URL", "AppleTV/Port");
  script_require_ports("Services/www", 7000);

  exit(0);
}

include("audit.inc");
include("appletv_func.inc");

url = get_kb_item('AppleTV/URL');
if (empty_or_null(url)) exit(0, 'Cannot determine Apple TV URL.');
port = get_kb_item('AppleTV/Port');
if (empty_or_null(port)) exit(0, 'Cannot determine Apple TV port.');

build = get_kb_item('AppleTV/Version');
if (empty_or_null(build)) audit(AUDIT_UNKNOWN_DEVICE_VER, 'Apple TV');

model = get_kb_item('AppleTV/Model');
if (empty_or_null(model)) exit(0, 'Cannot determine Apple TV model.');

fixed_build = "12H523";
tvos_ver = '7.2.1';
gen = APPLETV_MODEL_GEN[model];

appletv_check_version(
  build          : build,
  fix            : fixed_build,
  affected_gen   : 3,
  model          : model,
  gen            : gen,
  fix_tvos_ver   : tvos_ver,
  port           : port,
  url            : url,
  severity       : SECURITY_HOLE
);

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2016-d132dbb529.
#

include("compat.inc");

if (description)
{
  script_id(89619);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_xref(name:"FEDORA", value:"2016-d132dbb529");

  script_name(english:"Fedora 22 : webkitgtk4-2.10.4-1.fc22 (2016-d132dbb529)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Update to 2.10.4. Major new features: * New HTTP disk cache for the
Network Process. * IndexedDB support. * New Web Inspector UI. *
Automatic ScreenServer inhibition when playing fullscreen videos. *
Initial Editor API.

  - Performance improvements. This update addresses the
    following vulnerabilities: * CVE-2015-1122 *
    CVE-2015-1152 * CVE-2015-1155 * CVE-2015-3660 *
    CVE-2015-3730 * CVE-2015-3738 * CVE-2015-3740 *
    CVE-2015-3742 * CVE-2015-3744 * CVE-2015-3746 *
    CVE-2015-3750 * CVE-2015-3751 * CVE-2015-3754 *
    CVE-2015-3755 * CVE-2015-5804 * CVE-2015-5805 *
    CVE-2015-5807 * CVE-2015-5810 * CVE-2015-5813 *
    CVE-2015-5814 * CVE-2015-5815 * CVE-2015-5817 *
    CVE-2015-5818 * CVE-2015-5825 * CVE-2015-5827 *
    CVE-2015-5828 * CVE-2015-5929 * CVE-2015-5930 *
    CVE-2015-5931 * CVE-2015-7002 * CVE-2015-7013 *
    CVE-2015-7014 * CVE-2015-7048 * CVE-2015-7095 *
    CVE-2015-7097 * CVE-2015-7099 * CVE-2015-7100 *
    CVE-2015-7102 * CVE-2015-7103 * CVE-2015-7104 For
    further information on the new features, see the [Igalia
    blog
    post](http://blogs.igalia.com/carlosgc/2015/09/21/webkit
    gtk-2-10/). For information on the security
    vulnerabilities, refer to [WebKitGTK+ Security Advisory
    WSA-2015-0002](http://webkitgtk.org/security/WSA-2015-00
    02.html).

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  # http://blogs.igalia.com/carlosgc/2015/09/21/webkitgtk-2-10/
  script_set_attribute(
    attribute:"see_also",
    value:"https://blogs.igalia.com/carlosgc/2015/09/21/webkitgtk-2-10/"
  );
  # http://webkitgtk.org/security/WSA-2015-0002.html
  script_set_attribute(
    attribute:"see_also",
    value:"https://webkitgtk.org/security/WSA-2015-0002.html"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2016-February/176536.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?e5712c42"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected webkitgtk4 package."
  );
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:webkitgtk4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:22");

  script_set_attribute(attribute:"patch_publication_date", value:"2016/02/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/03/04");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^22([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 22.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC22", reference:"webkitgtk4-2.10.4-1.fc22")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "webkitgtk4");
}

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(85446);
  script_version("1.4");
  script_cvs_date("Date: 2018/07/14  1:59:36");

  script_cve_id(
    "CVE-2015-3729",
    "CVE-2015-3730",
    "CVE-2015-3731",
    "CVE-2015-3732",
    "CVE-2015-3733",
    "CVE-2015-3734",
    "CVE-2015-3735",
    "CVE-2015-3736",
    "CVE-2015-3737",
    "CVE-2015-3738",
    "CVE-2015-3739",
    "CVE-2015-3740",
    "CVE-2015-3741",
    "CVE-2015-3742",
    "CVE-2015-3743",
    "CVE-2015-3744",
    "CVE-2015-3745",
    "CVE-2015-3746",
    "CVE-2015-3747",
    "CVE-2015-3748",
    "CVE-2015-3749",
    "CVE-2015-3750",
    "CVE-2015-3751",
    "CVE-2015-3752",
    "CVE-2015-3753",
    "CVE-2015-3754",
    "CVE-2015-3755"
  );
  script_bugtraq_id(
    76338,
    76339,
    76341,
    76342,
    76344
  );

  script_name(english:"Mac OS X : Apple Safari < 6.2.8 / 7.1.8 / 8.0.8 Multiple Vulnerabilities");
  script_summary(english:"Checks the Safari version.");

  script_set_attribute(attribute:"synopsis", value:
"The web browser installed on the remote host is affected by multiple
vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Apple Safari installed on the remote Mac OS X host is
prior to 6.2.8 / 7.1.8 / 8.0.8. It is, therefore, affected by the
following vulnerabilities :

  - An unspecified flaw exists that allows an attacker to
    spoof UI elements by using crafted web pages.
    (CVE-2015-3729)

  - Multiple memory corruption flaws exist in WebKit due
    to improper validation of user-supplied input. An
    attacker can exploit these, by using a crafted web page,
    to execute arbitrary code. (CVE-2015-3730, CVE-2015-3731
    CVE-2015-3732, CVE-2015-3733, CVE-2015-3734,
    CVE-2015-3735, CVE-2015-3736, CVE-2015-3737,
    CVE-2015-3738, CVE-2015-3739, CVE-2015-3740,
    CVE-2015-3741, CVE-2015-3742, CVE-2015-3743,
    CVE-2015-3744, CVE-2015-3745, CVE-2015-3746,
    CVE-2015-3747, CVE-2015-3748, CVE-2015-3749)

  - A security policy bypass vulnerability exists in WebKit
    related to handling Content Security Policy report
    requests. An attacker can exploit this to bypass the
    HTTP Strict Transport Security policy. (CVE-2015-3750)

  - A security policy bypass vulnerability exists in WebKit
    that allows websites to use video controls to load
    images nested in object elements in violation of Content
    Security Policy directives. (CVE-2015-3751)

  - An information disclosure vulnerability exists in WebKit
    related to how cookies are added to Content Security
    Policy report requests, which results in cookies being
    exposed to cross-origin requests. Also, cookies set
    during regular browsing are sent during private
    browsing. (CVE-2015-3752)

  - An information disclosure vulnerability exists in the
    WebKit Canvas component when images are called using
    URLs that redirect to a data:image resource. An
    attacker, using a malicious website, can exploit this to
    disclose image data cross-origin. (CVE-2015-3753)

  - An information disclosure vulnerability exists in WebKit
    page loading where the caching of HTTP authentication
    credentials entered in private browsing mode were carried
    over into regular browsing, resulting in a user's private
    browsing history being exposed. (CVE-2015-3754)

  - A flaw in the WebKit process model allows a malicious
    website to display an arbitrary URL, which can allow
    user interface spoofing. (CVE-2015-3755)");
  script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT205033");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apple Safari 6.2.8 / 7.1.8 / 8.0.8 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2015/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2015/08/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apple:safari");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.");

  script_dependencies("macosx_Safari31.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version", "MacOSX/Safari/Installed");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
os = get_kb_item("Host/MacOSX/Version");
if (!os) audit(AUDIT_OS_NOT, "Mac OS X");

if (!ereg(pattern:"Mac OS X 10\.([89]|10)([^0-9]|$)", string:os)) audit(AUDIT_OS_NOT, "Mac OS X 10.8 / 10.9 / 10.10");

get_kb_item_or_exit("MacOSX/Safari/Installed");
path = get_kb_item_or_exit("MacOSX/Safari/Path", exit_code:1);
version = get_kb_item_or_exit("MacOSX/Safari/Version", exit_code:1);
fixed_version = NULL;

if ("10.8" >< os)
  fixed_version = "6.2.8";
else if ("10.9" >< os)
  fixed_version = "7.1.8";
else
  fixed_version = "8.0.8";

if (ver_compare(ver:version, fix:fixed_version, strict:FALSE) == -1)
{
  if (report_verbosity > 0)
  {
    report =
      '\n  Path              : ' + path +
      '\n  Installed version : ' + version +
      '\n  Fixed version     : ' + fixed_version + '\n';
    security_warning(port:0, extra:report);
  }
  else security_warning(0);
}
else audit(AUDIT_INST_PATH_NOT_VULN, "Safari", version, path);