Vulnerabilities > CVE-2017-7013 - Out-of-bounds Read vulnerability in Apple products

047910
CVSS 6.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
apple
microsoft
CWE-125
nessus

Summary

An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. watchOS before 3.2.3 is affected. The issue involves the "libxml2" component. It allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted XML file.

Vulnerable Configurations

Part Description Count
Application
Apple
220
OS
Microsoft
1
OS
Apple
330

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Overread Buffers
    An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

Nessus

  • NASL familyPeer-To-Peer File Sharing
    NASL idITUNES_12_6_2_BANNER.NASL
    descriptionThe version of Apple iTunes running on the remote host is prior to 12.6.2. It is, therefore, affected by multiple vulnerabilities : - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote attacker can exploit these to disclose user information. (CVE-2017-7010, CVE-2017-7013) - Multiple memory corruption issues exist in the Webkit Web Inspector component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these, via a specially crafted web page, to corrupt memory, resulting in the execution of arbitrary code. (CVE-2017-7012) - Multiple memory corruption issues exist in the WebKit component due to improper validation of input. An unauthenticated, remote attacker can exploit these issues, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7018, CVE-2017-7020, CVE-2017-7030, CVE-2017-7034, CVE-2017-7037, CVE-2017-7039, CVE-2017-7040, CVE-2017-7041, CVE-2017-7042, CVE-2017-7043, CVE-2017-7046, CVE-2017-7048, CVE-2017-7049, CVE-2017-7052, CVE-2017-7055, CVE-2017-7056, CVE-2017-7061) - A memory corruption issue exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id101955
    published2017-07-25
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101955
    titleApple iTunes < 12.6.2 Multiple Vulnerabilities (uncredentialed check)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(101955);
      script_version("1.5");
      script_cvs_date("Date: 2019/11/12");
    
      script_cve_id(
        "CVE-2017-7010",
        "CVE-2017-7012",
        "CVE-2017-7013",
        "CVE-2017-7018",
        "CVE-2017-7019",
        "CVE-2017-7020",
        "CVE-2017-7030",
        "CVE-2017-7034",
        "CVE-2017-7037",
        "CVE-2017-7039",
        "CVE-2017-7040",
        "CVE-2017-7041",
        "CVE-2017-7042",
        "CVE-2017-7043",
        "CVE-2017-7046",
        "CVE-2017-7048",
        "CVE-2017-7049",
        "CVE-2017-7052",
        "CVE-2017-7053",
        "CVE-2017-7055",
        "CVE-2017-7056",
        "CVE-2017-7061",
        "CVE-2017-7064"
      );
      script_bugtraq_id(
        99879,
        99884,
        99885,
        99889,
        99890
      );
      script_xref(name:"APPLE-SA", value:"APPLE-SA-2017-07-19-6");
    
      script_name(english:"Apple iTunes < 12.6.2 Multiple Vulnerabilities (uncredentialed check)");
      script_summary(english:"Checks the version of iTunes.");
    
      script_set_attribute(attribute:"synopsis", value:
    "An application running on the remote host is affected by multiple
    vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Apple iTunes running on the remote host is prior to
    12.6.2. It is, therefore, affected by multiple vulnerabilities :
    
      - Multiple out-of-bounds read errors exist in the libxml2
        component due to improper handling of specially crafted
        XML documents. An unauthenticated, remote attacker can
        exploit these to disclose user information.
        (CVE-2017-7010, CVE-2017-7013)
    
      - Multiple memory corruption issues exist in the Webkit
        Web Inspector component due to improper validation of
        user-supplied input. An unauthenticated, remote attacker
        can exploit these, via a specially crafted web page, to
        corrupt memory, resulting in the execution of arbitrary
        code. (CVE-2017-7012)
    
      - Multiple memory corruption issues exist in the WebKit
        component due to improper validation of input. An
        unauthenticated, remote attacker can exploit these
        issues, via a specially crafted web page, to execute
        arbitrary code. (CVE-2017-7018, CVE-2017-7020,
        CVE-2017-7030, CVE-2017-7034, CVE-2017-7037,
        CVE-2017-7039, CVE-2017-7040, CVE-2017-7041,
        CVE-2017-7042, CVE-2017-7043, CVE-2017-7046,
        CVE-2017-7048, CVE-2017-7049, CVE-2017-7052,
        CVE-2017-7055, CVE-2017-7056, CVE-2017-7061)
    
      - A memory corruption issue exists in the 'WebKit Page
        Loading' component due to improper validation of input.
        An unauthenticated, remote attacker can exploit this,
        via a specially crafted web page, to execute arbitrary
        code. (CVE-2017-7019)
    
      - A flaw exists in the iPodService component when handling
        the iPodManager COM control due to insufficient access
        restrictions. A local attacker can exploit this, via
        a specially crafted application, to execute arbitrary
        code with system privileges. (CVE-2017-7053)
    
      - An unspecified memory initialization issue exists in
        Webkit. A local attacker can exploit this, via a
        specially crafted application, to disclose the contents
        of restricted memory. (CVE-2017-7064)
    
    Note that Nessus has not tested for these issues but has instead
    relied only on the application's self-reported version number.");
      script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT207928");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Apple iTunes version 12.6.2 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-7053");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/07/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/07/25");
    
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:apple:itunes");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Peer-To-Peer File Sharing");
    
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("itunes_sharing.nasl");
      script_require_keys("iTunes/sharing");
      script_require_ports("Services/www", 3689);
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("http.inc");
    
    port = get_http_port(default:3689, embedded:TRUE, ignore_broken:TRUE);
    
    get_kb_item_or_exit("iTunes/" + port + "/enabled");
    
    type = get_kb_item_or_exit("iTunes/" + port + "/type");
    source = get_kb_item_or_exit("iTunes/" + port + "/source");
    version = get_kb_item_or_exit("iTunes/" + port + "/version");
    
    fixed_version = "12.6.2";
    
    if (ver_compare(ver:version, fix:fixed_version, strict:FALSE) < 0)
    {
      report = '\n  Version source    : ' + source +
               '\n  Installed version : ' + version +
               '\n  Fixed version     : ' + fixed_version +
               '\n';
      security_report_v4(port:port, extra:report, severity:SECURITY_HOLE);
    }
    else audit(AUDIT_LISTEN_NOT_VULN, "iTunes", port, version);
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2017-003.NASL
    descriptionThe remote host is running Mac OS X 10.10.5, Mac OS X 10.11.6, or macOS 10.12.5 and is missing a security update. It is therefore, affected by multiple vulnerabilities : - An overflow condition exists in the curl component in the dprintf_formatf() function that is triggered when handling floating point conversion. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-9586) - A flaw exits in the curl component in the randit() function within file lib/rand.c due to improper initialization of the 32-bit random value, which is used, for example, to generate Digest and NTLM authentication nonces, resulting in weaker cryptographic operations than expected. (CVE-2016-9594) - A flaw exists in the curl component in the allocate_conn() function in lib/url.c when using the OCSP stapling feature for checking a X.509 certificate revocation status. The issue is triggered as the request option for OCSP stapling is not properly passed to the TLS library, resulting in no error being returned even when no proof of the validity of the certificate could be provided. A man-in-the-middle attacker can exploit this to provide a revoked certificate. (CVE-2017-2629) - A remote code execution vulnerability exists in the CoreAudio component due to improper validation of user-supplied input when handling movie files. An unauthenticated, remote attacker can exploit this, by convincing a user to play a specially crafted movie file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7008) - A memory corruption issue exists in the IOUSBFamily component due to improper validation of user-supplied input. A local attacker can exploit this, via a specially crafted application, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7009) - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote attacker can exploit these to disclose user information. (CVE-2017-7010, CVE-2017-7013) - Multiple memory corruption issues exist in the Intel Graphics Driver component due to improper validation of input. A local attacker can exploit these issues to execute arbitrary code with elevated privileges. (CVE-2017-7014, CVE-2017-7017, CVE-2017-7035, CVE-2017-7044) - A remote code execution vulnerability exists in the Audio component due to improper validation of user-supplied input when handling audio files. An unauthenticated, remote attacker can exploit this, by convincing a user to play a specially crafted audio file, to execute arbitrary code. (CVE-2017-7015) - Multiple remote code execution vulnerabilities exist in the afclip component due to improper validation of user-supplied input when handling audio files. An unauthenticated, remote attacker can exploit these vulnerabilities, by convincing a user to play a specially crafted audio file, to execute arbitrary code. (CVE-2017-7016, CVE-2017-7033) - A memory corruption issue exists in the AppleGraphicsPowerManagement component due to improper validation of input. A local attacker can exploit this to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7021) - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7022, CVE-2017-7024, CVE-2017-7026) - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with kernel privileges. (CVE-2017-7023, CVE-2017-7025, CVE-2017-7027, CVE-2017-7069) - Multiple unspecified flaws exist in the kernel due to a failure to properly sanitize input. A local attacker can exploit these issues, via a specially crafted application, to disclose restricted memory contents. (CVE-2017-7028, CVE-2017-7029, CVE-2017-7067) - A flaw exists in the Foundation component due to improper validation of input. A unauthenticated, remote attacker can exploit this, by convincing a user to open specially crafted file, to execute arbitrary code. (CVE-2017-7031) - A memory corruption issue exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id101957
    published2017-07-25
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101957
    titlemacOS and Mac OS X Multiple Vulnerabilities (Security Update 2017-003)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(101957);
      script_version("1.7");
      script_cvs_date("Date: 2019/11/12");
    
      script_cve_id(
        "CVE-2016-9586",
        "CVE-2016-9594",
        "CVE-2017-2629",
        "CVE-2017-7008",
        "CVE-2017-7009",
        "CVE-2017-7010",
        "CVE-2017-7013",
        "CVE-2017-7014",
        "CVE-2017-7015",
        "CVE-2017-7016",
        "CVE-2017-7017",
        "CVE-2017-7021",
        "CVE-2017-7022",
        "CVE-2017-7023",
        "CVE-2017-7024",
        "CVE-2017-7025",
        "CVE-2017-7026",
        "CVE-2017-7027",
        "CVE-2017-7028",
        "CVE-2017-7029",
        "CVE-2017-7031",
        "CVE-2017-7032",
        "CVE-2017-7033",
        "CVE-2017-7035",
        "CVE-2017-7036",
        "CVE-2017-7044",
        "CVE-2017-7045",
        "CVE-2017-7047",
        "CVE-2017-7050",
        "CVE-2017-7051",
        "CVE-2017-7054",
        "CVE-2017-7062",
        "CVE-2017-7067",
        "CVE-2017-7068",
        "CVE-2017-7069",
        "CVE-2017-7468",
        "CVE-2017-9417"
      );
      script_bugtraq_id(
        95019,
        95094,
        96382,
        97962,
        99482,
        99879,
        99880,
        99882,
        99883,
        99889
      );
      script_xref(name:"APPLE-SA", value:"APPLE-SA-2017-05-15-1");
    
      script_name(english:"macOS and Mac OS X Multiple Vulnerabilities (Security Update 2017-003)");
      script_summary(english:"Checks for the presence of Security Update 2017-003.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote host is missing a macOS or Mac OS X security update that
    fixes multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote host is running Mac OS X 10.10.5, Mac OS X 10.11.6, or
    macOS 10.12.5 and is missing a security update. It is therefore,
    affected by multiple vulnerabilities :
    
      - An overflow condition exists in the curl component in
        the dprintf_formatf() function that is triggered when
        handling floating point conversion. An unauthenticated,
        remote attacker can exploit this to cause a denial of
        service condition or the execution of arbitrary code.
        (CVE-2016-9586)
    
      - A flaw exits in the curl component in the randit()
        function within file lib/rand.c due to improper
        initialization of the 32-bit random value, which is
        used, for example, to generate Digest and NTLM
        authentication nonces, resulting in weaker cryptographic
        operations than expected. (CVE-2016-9594)
    
      - A flaw exists in the curl component in the
        allocate_conn() function in lib/url.c when using the
        OCSP stapling feature for checking a X.509 certificate
        revocation status. The issue is triggered as the request
        option for OCSP stapling is not properly passed to the
        TLS library, resulting in no error being returned even
        when no proof of the validity of the certificate could
        be provided. A man-in-the-middle attacker can exploit
        this to provide a revoked certificate. (CVE-2017-2629)
    
      - A remote code execution vulnerability exists in the
        CoreAudio component due to improper validation of
        user-supplied input when handling movie files. An
        unauthenticated, remote attacker can exploit this, by
        convincing a user to play a specially crafted movie
        file, to cause a denial of service condition or the
        execution of arbitrary code. (CVE-2017-7008)
    
      - A memory corruption issue exists in the IOUSBFamily
        component due to improper validation of user-supplied
        input. A local attacker can exploit this, via a
        specially crafted application, to cause a denial of
        service condition or the execution of arbitrary code.
        (CVE-2017-7009)
    
      - Multiple out-of-bounds read errors exist in the libxml2
        component due to improper handling of specially crafted
        XML documents. An unauthenticated, remote attacker can
        exploit these to disclose user information.
        (CVE-2017-7010, CVE-2017-7013)
    
      - Multiple memory corruption issues exist in the Intel
        Graphics Driver component due to improper validation of
        input. A local attacker can exploit these issues to
        execute arbitrary code with elevated privileges.
        (CVE-2017-7014, CVE-2017-7017, CVE-2017-7035,
        CVE-2017-7044)
    
      - A remote code execution vulnerability exists in the
        Audio component due to improper validation of
        user-supplied input when handling audio files. An
        unauthenticated, remote attacker can exploit this, by
        convincing a user to play a specially crafted audio
        file, to execute arbitrary code. (CVE-2017-7015)
    
      - Multiple remote code execution vulnerabilities exist in
        the afclip component due to improper validation of
        user-supplied input when handling audio files. An
        unauthenticated, remote attacker can exploit these
        vulnerabilities, by convincing a user to play a
        specially crafted audio file, to execute arbitrary
        code. (CVE-2017-7016, CVE-2017-7033)
    
      - A memory corruption issue exists in the
        AppleGraphicsPowerManagement component due to improper
        validation of input. A local attacker can exploit this
        to cause a denial of service condition or the execution
        of arbitrary code with system privileges.
        (CVE-2017-7021)
    
      - Multiple memory corruption issues exist in the kernel
        due to improper validation of input. A local attacker
        can exploit these issues to cause a denial of service
        condition or the execution of arbitrary code with system
        privileges. (CVE-2017-7022, CVE-2017-7024,
        CVE-2017-7026)
    
      - Multiple memory corruption issues exist in the kernel
        due to improper validation of input. A local attacker
        can exploit these issues to cause a denial of service
        condition or the execution of arbitrary code with kernel
        privileges. (CVE-2017-7023, CVE-2017-7025,
        CVE-2017-7027, CVE-2017-7069)
    
      - Multiple unspecified flaws exist in the kernel due to a
        failure to properly sanitize input. A local attacker can
        exploit these issues, via a specially crafted
        application, to disclose restricted memory contents.
        (CVE-2017-7028, CVE-2017-7029, CVE-2017-7067)
    
      - A flaw exists in the Foundation component due to
        improper validation of input. A unauthenticated, remote
        attacker can exploit this, by convincing a user to open
        specially crafted file, to execute arbitrary code.
        (CVE-2017-7031)
    
      - A memory corruption issue exists in the 'kext tools'
        component due to improper validation of input. A local
        attacker can exploit this to execute arbitrary code with
        elevated privileges. (CVE-2017-7032)
    
      - Multiple unspecified flaws exist in the Intel Graphics
        Driver component due to a failure to properly sanitize
        input. A local attacker can exploit these issues, via a
        specially crafted application, to disclose restricted
        memory contents. (CVE-2017-7036, CVE-2017-7045)
    
      - A memory corruption issue exists in the libxpc component
        due to improper validation of input. A local attacker
        can exploit this issue, via a specifically crafted
        application, to cause a denial of service condition or
        the execution of arbitrary code with system privileges.
        (CVE-2017-7047)
    
      - Multiple memory corruption issues exist in the
        Bluetooth component due to improper validation of input.
        A local attacker can exploit these issues to execute
        arbitrary code with system privileges. (CVE-2017-7050,
        CVE-2017-7051)
    
      - A memory corruption issue exists in the Bluetooth
        component due to improper validation of input. A local
        attacker can exploit these issues to execute arbitrary
        code with system privileges. (CVE-2017-7054)
    
      - A buffer overflow condition exists in the Contacts
        component due to improper validation of user-supplied
        input. An unauthenticated, remote attacker can exploit
        this to cause a denial of service condition or the
        execution of arbitrary code. (CVE-2017-7062)
    
      - A buffer overflow condition exists in the libarchive
        component due to improper validation of user-supplied
        input. An unauthenticated, remote attacker can exploit
        this, via a specially crafted archive file, to cause a
        denial of service condition or the execution of
        arbitrary code. (CVE-2017-7068)
    
      - A certificate validation bypass vulnerability exists in
        the curl component due to the program attempting to
        resume TLS sessions even if the client certificate
        fails. An unauthenticated, remote attacker can exploit
        this to bypass validation mechanisms. (CVE-2017-7468)
    
      - A memory corruption issue exists in the Broadcom BCM43xx
        family Wi-Fi Chips component that allows an
        unauthenticated, remote attacker to execute arbitrary
        code. (CVE-2017-9417)");
      script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT207922");
      script_set_attribute(attribute:"see_also", value:"http://seclists.org/fulldisclosure/2017/May/47");
      script_set_attribute(attribute:"solution", value:
    "Install Security Update 2017-003 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-7069");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/07/01");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/07/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/07/25");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:macos");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version", "Host/MacOSX/packages/boms");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    
    # Compare 2 patch numbers to determine if patch requirements are satisfied.
    # Return true if this patch or a later patch is applied
    # Return false otherwise
    function check_patch(year, number)
    {
      local_var p_split = split(patch, sep:"-");
      local_var p_year  = int( p_split[0]);
      local_var p_num   = int( p_split[1]);
    
      if (year >  p_year) return TRUE;
      else if (year <  p_year) return FALSE;
      else if (number >=  p_num) return TRUE;
      else return FALSE;
    }
    
    get_kb_item_or_exit("Host/local_checks_enabled");
    os = get_kb_item_or_exit("Host/MacOSX/Version");
    
    if (!preg(pattern:"Mac OS X 10\.(10\.5|11\.6|12\.5)([^0-9]|$)", string:os))
      audit(AUDIT_OS_NOT, "Mac OS X 10.10.5 or Mac OS X 10.11.6 or Mac OS X 10.12.5");
    
    if ("10.10.5" >< os || "10.11.6" >< os || "10.12.5" >< os) patch = "2017-003";
    
    packages = get_kb_item_or_exit("Host/MacOSX/packages/boms", exit_code:1);
    sec_boms_report = pgrep(
      pattern:"^com\.apple\.pkg\.update\.(security\.|os\.SecUpd).*bom$",
      string:packages
    );
    sec_boms = split(sec_boms_report, sep:'\n');
    
    foreach package (sec_boms)
    {
      # Grab patch year and number
      match = eregmatch(pattern:"[^0-9](20[0-9][0-9])[-.]([0-9]{3})[^0-9]", string:package);
      if (empty_or_null(match[1]) || empty_or_null(match[2]))
        continue;
    
      patch_found = check_patch(year:int(match[1]), number:int(match[2]));
      if (patch_found) exit(0, "The host has Security Update " + patch + " or later installed and is therefore not affected.");
    }
    
    report =  '\n  Missing security update : ' + patch;
    report += '\n  Installed security BOMs : ';
    if (sec_boms_report) report += str_replace(find:'\n', replace:'\n                            ', string:sec_boms_report);
    else report += 'n/a';
    report += '\n';
    
    security_report_v4(port:0, severity:SECURITY_HOLE, extra:report);
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOS_ITUNES_12_6_2.NASL
    descriptionThe version of Apple iTunes installed on the remote macOS or Mac OS X host is prior to 12.6.2. It is, therefore, affected by multiple vulnerabilities : - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote attacker can exploit these to disclose user information. (CVE-2017-7010, CVE-2017-7013) - Multiple memory corruption issues exist in the Webkit Web Inspector component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these, via a specially crafted web page, to corrupt memory, resulting in the execution of arbitrary code. (CVE-2017-7012) - Multiple memory corruption issues exist in the WebKit component due to improper validation of input. An unauthenticated, remote attacker can exploit these issues, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7018, CVE-2017-7020, CVE-2017-7030, CVE-2017-7034, CVE-2017-7037, CVE-2017-7039, CVE-2017-7040, CVE-2017-7041, CVE-2017-7042, CVE-2017-7043, CVE-2017-7046, CVE-2017-7048, CVE-2017-7049, CVE-2017-7052, CVE-2017-7055, CVE-2017-7056, CVE-2017-7061) - A memory corruption issue exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id101956
    published2017-07-25
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101956
    titleApple iTunes < 12.6.2 Multiple Vulnerabilities (macOS) (credentialed check)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(101956);
      script_version("1.5");
      script_cvs_date("Date: 2019/11/12");
    
      script_cve_id(
        "CVE-2017-7010",
        "CVE-2017-7012",
        "CVE-2017-7013",
        "CVE-2017-7018",
        "CVE-2017-7019",
        "CVE-2017-7020",
        "CVE-2017-7030",
        "CVE-2017-7034",
        "CVE-2017-7037",
        "CVE-2017-7039",
        "CVE-2017-7040",
        "CVE-2017-7041",
        "CVE-2017-7042",
        "CVE-2017-7043",
        "CVE-2017-7046",
        "CVE-2017-7048",
        "CVE-2017-7049",
        "CVE-2017-7052",
        "CVE-2017-7053",
        "CVE-2017-7055",
        "CVE-2017-7056",
        "CVE-2017-7061",
        "CVE-2017-7064"
      );
      script_bugtraq_id(
        99879,
        99884,
        99885,
        99889,
        99890
      );
      script_xref(name:"APPLE-SA", value:"APPLE-SA-2017-07-19-6");
    
      script_name(english:"Apple iTunes < 12.6.2 Multiple Vulnerabilities (macOS) (credentialed check)");
      script_summary(english:"Checks the version of iTunes.");
    
      script_set_attribute(attribute:"synopsis", value:
    "An application installed on the remote host is affected by multiple
    vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Apple iTunes installed on the remote macOS or Mac OS X
    host is prior to 12.6.2. It is, therefore, affected by multiple
    vulnerabilities :
    
      - Multiple out-of-bounds read errors exist in the libxml2
        component due to improper handling of specially crafted
        XML documents. An unauthenticated, remote attacker can
        exploit these to disclose user information.
        (CVE-2017-7010, CVE-2017-7013)
    
      - Multiple memory corruption issues exist in the Webkit
        Web Inspector component due to improper validation of
        user-supplied input. An unauthenticated, remote attacker
        can exploit these, via a specially crafted web page, to
        corrupt memory, resulting in the execution of arbitrary
        code. (CVE-2017-7012)
    
      - Multiple memory corruption issues exist in the WebKit
        component due to improper validation of input. An
        unauthenticated, remote attacker can exploit these
        issues, via a specially crafted web page, to execute
        arbitrary code. (CVE-2017-7018, CVE-2017-7020,
        CVE-2017-7030, CVE-2017-7034, CVE-2017-7037,
        CVE-2017-7039, CVE-2017-7040, CVE-2017-7041,
        CVE-2017-7042, CVE-2017-7043, CVE-2017-7046,
        CVE-2017-7048, CVE-2017-7049, CVE-2017-7052,
        CVE-2017-7055, CVE-2017-7056, CVE-2017-7061)
    
      - A memory corruption issue exists in the 'WebKit Page
        Loading' component due to improper validation of input.
        An unauthenticated, remote attacker can exploit this,
        via a specially crafted web page, to execute arbitrary
        code. (CVE-2017-7019)
    
      - A flaw exists in the iPodService component when handling
        the iPodManager COM control due to insufficient access
        restrictions. A local attacker can exploit this to
        execute arbitrary code with system privileges.
        (CVE-2017-7053)
    
      - An unspecified memory initialization issue exists in
        Webkit. A local attacker can exploit this, via a
        specially crafted application, to disclose the contents
        of restricted memory. (CVE-2017-7064)
    
    Note that Nessus has not tested for these issues but has instead
    relied only on the application's self-reported version number.");
      script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT207928");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Apple iTunes version 12.6.2 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-7053");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/07/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/07/25");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:apple:itunes");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("macosx_itunes_detect.nasl");
      script_require_keys("Host/MacOSX/Version", "installed_sw/iTunes");
    
      exit(0);
    }
    
    include("vcf.inc");
    
    os = get_kb_item("Host/MacOSX/Version");
    if (!os) audit(AUDIT_OS_NOT, "Mac OS X");
    
    app_info = vcf::get_app_info(app:"iTunes");
    
    constraints = [{"fixed_version" : "12.6.2"}];
    
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);
    
  • NASL familyWindows
    NASL idITUNES_12_6_2.NASL
    descriptionThe version of Apple iTunes installed on the remote Windows host is prior to 12.6.2. It is, therefore, affected by multiple vulnerabilities : - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote attacker can exploit these to disclose user information. (CVE-2017-7010, CVE-2017-7013) - Multiple memory corruption issues exist in the Webkit Web Inspector component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these, via a specially crafted web page, to corrupt memory, resulting in the execution of arbitrary code. (CVE-2017-7012) - Multiple memory corruption issues exist in the WebKit component due to improper validation of input. An unauthenticated, remote attacker can exploit these issues, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7018, CVE-2017-7020, CVE-2017-7030, CVE-2017-7034, CVE-2017-7037, CVE-2017-7039, CVE-2017-7040, CVE-2017-7041, CVE-2017-7042, CVE-2017-7043, CVE-2017-7046, CVE-2017-7048, CVE-2017-7049, CVE-2017-7052, CVE-2017-7055, CVE-2017-7056, CVE-2017-7061) - A memory corruption issue exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id101954
    published2017-07-25
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101954
    titleApple iTunes < 12.6.2 Multiple Vulnerabilities (credentialed check)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(101954);
      script_version("1.5");
      script_cvs_date("Date: 2019/11/12");
    
      script_cve_id(
        "CVE-2017-7010",
        "CVE-2017-7012",
        "CVE-2017-7013",
        "CVE-2017-7018",
        "CVE-2017-7019",
        "CVE-2017-7020",
        "CVE-2017-7030",
        "CVE-2017-7034",
        "CVE-2017-7037",
        "CVE-2017-7039",
        "CVE-2017-7040",
        "CVE-2017-7041",
        "CVE-2017-7042",
        "CVE-2017-7043",
        "CVE-2017-7046",
        "CVE-2017-7048",
        "CVE-2017-7049",
        "CVE-2017-7052",
        "CVE-2017-7053",
        "CVE-2017-7055",
        "CVE-2017-7056",
        "CVE-2017-7061",
        "CVE-2017-7064"
      );
      script_bugtraq_id(
        99879,
        99884,
        99885,
        99889,
        99890
      );
      script_xref(name:"APPLE-SA", value:"APPLE-SA-2017-07-19-6");
    
      script_name(english:"Apple iTunes < 12.6.2 Multiple Vulnerabilities (credentialed check)");
      script_summary(english:"Checks the version of iTunes on Windows.");
    
      script_set_attribute(attribute:"synopsis", value:
    "An application installed on the remote host is affected by multiple
    vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Apple iTunes installed on the remote Windows host is
    prior to 12.6.2. It is, therefore, affected by multiple
    vulnerabilities :
    
      - Multiple out-of-bounds read errors exist in the libxml2
        component due to improper handling of specially crafted
        XML documents. An unauthenticated, remote attacker can
        exploit these to disclose user information.
        (CVE-2017-7010, CVE-2017-7013)
    
      - Multiple memory corruption issues exist in the Webkit
        Web Inspector component due to improper validation of
        user-supplied input. An unauthenticated, remote attacker
        can exploit these, via a specially crafted web page, to
        corrupt memory, resulting in the execution of arbitrary
        code. (CVE-2017-7012)
    
      - Multiple memory corruption issues exist in the WebKit
        component due to improper validation of input. An
        unauthenticated, remote attacker can exploit these
        issues, via a specially crafted web page, to execute
        arbitrary code. (CVE-2017-7018, CVE-2017-7020,
        CVE-2017-7030, CVE-2017-7034, CVE-2017-7037,
        CVE-2017-7039, CVE-2017-7040, CVE-2017-7041,
        CVE-2017-7042, CVE-2017-7043, CVE-2017-7046,
        CVE-2017-7048, CVE-2017-7049, CVE-2017-7052,
        CVE-2017-7055, CVE-2017-7056, CVE-2017-7061)
    
      - A memory corruption issue exists in the 'WebKit Page
        Loading' component due to improper validation of input.
        An unauthenticated, remote attacker can exploit this,
        via a specially crafted web page, to execute arbitrary
        code. (CVE-2017-7019)
    
      - A flaw exists in the iPodService component when handling
        the iPodManager COM control due to insufficient access
        restrictions. A local attacker can exploit this to
        execute arbitrary code with system privileges.
        (CVE-2017-7053)
    
      - An unspecified memory initialization issue exists in
        Webkit. A local attacker can exploit this, via a
        specially crafted application, to disclose the contents
        of restricted memory. (CVE-2017-7064)
    
    Note that Nessus has not tested for these issues but has instead
    relied only on the application's self-reported version number.");
      script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT207928");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Apple iTunes version 12.6.2 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-7053");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/07/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/07/25");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:apple:itunes");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("itunes_detect.nasl");
      script_require_keys("installed_sw/iTunes Version", "SMB/Registry/Enumerated");
    
      exit(0);
    }
    
    include("vcf.inc");
    
    # Ensure this is Windows
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    
    app_info = vcf::get_app_info(app:"iTunes Version", win_local:TRUE);
    
    constraints = [{"fixed_version" : "12.6.2"}];
    
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);