Vulnerabilities > CVE-2019-6235 - Out-of-bounds Write vulnerability in Apple products

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(121393);
  script_version("1.5");
  script_cvs_date("Date: 2019/10/31 15:18:51");

  script_cve_id(
    "CVE-2018-20346",
    "CVE-2018-20505",
    "CVE-2018-20506",
    "CVE-2019-6200",
    "CVE-2019-6202",
    "CVE-2019-6205",
    "CVE-2019-6208",
    "CVE-2019-6209",
    "CVE-2019-6210",
    "CVE-2019-6211",
    "CVE-2019-6213",
    "CVE-2019-6214",
    "CVE-2019-6218",
    "CVE-2019-6219",
    "CVE-2019-6220",
    "CVE-2019-6221",
    "CVE-2019-6224",
    "CVE-2019-6225",
    "CVE-2019-6230",
    "CVE-2019-6231",
    "CVE-2019-6235"
  );
  script_bugtraq_id(106323, 106693, 106694);
  script_xref(name:"APPLE-SA", value:"APPLE-SA-2019-1-22-2");

  script_name(english:"macOS 10.14.x < 10.14.3 Multiple Vulnerabilities");
  script_summary(english:"Checks the version of Mac OS X / macOS.");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a macOS update that fixes multiple security
vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote host is running a version of macOS / Mac OS X that is
10.14.x prior to 10.14.3. It is, therefore, affected by multiple
vulnerabilities related to the following components:

  - AppleKeyStore
  - Bluetooth
  - Core Media
  - CoreAnimation
  - FaceTime
  - IOKit
  - Kernel
  - libxpc
  - Natural Language Processing
  - QuartzCore
  - SQLite
  - WebRTC

Note that successful exploitation of the most serious issues can
result in arbitrary code execution.");
  script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT209446");
  # https://lists.apple.com/archives/security-announce/2019/Jan/msg00001.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a77b9bea");
  script_set_attribute(attribute:"solution", value:
"Upgrade to macOS version 10.14.3 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6218");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/01/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/25");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:macos");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl", "os_fingerprint.nasl");
  script_require_ports("Host/MacOSX/Version", "Host/OS");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");


fix = "10.14.3";
minver = "10.14";

os = get_kb_item("Host/MacOSX/Version");
if (!os)
{
  os = get_kb_item_or_exit("Host/OS");
  if ("Mac OS X" >!< os) audit(AUDIT_OS_NOT, "macOS / Mac OS X");

  c = get_kb_item("Host/OS/Confidence");
  if (c <= 70) exit(1, "Can't determine the host's OS with sufficient confidence.");
}
if (!os) audit(AUDIT_OS_NOT, "macOS / Mac OS X");

matches = pregmatch(pattern:"Mac OS X ([0-9]+(\.[0-9]+)+)", string:os);
if (empty_or_null(matches)) exit(1, "Failed to parse the macOS / Mac OS X version ('" + os + "').");

version = matches[1];

if (ver_compare(ver:version, minver:minver, fix:fix, strict:FALSE) == -1)
{
  security_report_v4(
    port:0,
    severity:SECURITY_HOLE,
    extra:
      '\n  Installed version : ' + version +
      '\n  Fixed version     : ' + fix +
      '\n'
  );
}
else audit(AUDIT_INST_VER_NOT_VULN, "macOS / Mac OS X", version);

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(121473);
  script_version("1.4");
  script_cvs_date("Date: 2019/10/31 15:18:52");

  script_cve_id(
    "CVE-2018-20346",
    "CVE-2018-20505",
    "CVE-2018-20506",
    "CVE-2019-6212",
    "CVE-2019-6215",
    "CVE-2019-6216",
    "CVE-2019-6217",
    "CVE-2019-6221",
    "CVE-2019-6226",
    "CVE-2019-6227",
    "CVE-2019-6229",
    "CVE-2019-6233",
    "CVE-2019-6234",
    "CVE-2019-6235"
  );
  script_bugtraq_id(
    106323,
    106691,
    106694,
    106696,
    106698,
    106699,
    106724
  );
  script_xref(name:"APPLE-SA", value:"APPLE-SA-2019-1-24-1");

  script_name(english:"Apple iTunes < 12.9.3 Multiple Vulnerabilities (credentialed check)");
  script_summary(english:"Checks the version of iTunes on Windows");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on remote host is affected by multiple
vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The version of Apple iTunes installed on the remote Windows host is
prior to 12.9.3. It is, therefore, affected by multiple vulnerabilities
as referenced in the HT209450 advisory:

  - Multiple vulnerabilities exist due to input processing
    flaws in the WebKit component. An attacker may be able
    to leverage one of these vulnerability, by providing
    maliciously crafted web content, to execute arbitrary
    code on the host. (CVE-2019-6212, CVE-2019-6215,
    CVE-2019-6216, CVE-2019-6217, CVE-2019-6226,
    CVE-2019-6227, CVE-2019-6233, CVE-2019-6234)

  - A universal cross-site scripting vulnerability exists in
    the WebKit component. An attacker may be able to leverage
    this vulnerability, by providing maliciously crafted web
    content, to execute arbitrary script code in the security
    context of any site. (CVE-2019-6229)

  - A memory corruption vulnerability exists in the
    AppleKeyStore component. An attacker may be able to
    leverage this vulnerability to allow a process to
    circumvent sandbox restrictions. (CVE-2019-6235)

  - An out-of-bounds read vulnerability exists in the
    Core Media component. An attacker may be able to leverage
    this vulnerability to allow a malicious application to
    elevate its privileges. (CVE-2019-6221)

  - Multiple memory corruption issues exist in the SQLite
    component. An attacker may be able to leverage these
    vulnerabilities, by executing a malicious SQL query, to
    execute arbitrary code on the host. (CVE-2018-20346,
    CVE-2018-20505, CVE-2018-20506)


Note that Nessus has not tested for this issue but has instead relied
only on the application's self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT209450");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apple iTunes version 12.9.3 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6235");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/01/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apple:itunes");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("itunes_detect.nasl");
  script_require_keys("installed_sw/iTunes Version", "SMB/Registry/Enumerated");

  exit(0);
}
include("vcf.inc");

get_kb_item_or_exit("SMB/Registry/Enumerated");

app_info = vcf::get_app_info(app:"iTunes Version", win_local:TRUE);
constraints = [{"fixed_version":"12.9.3"}];
vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE, flags:{xss:TRUE});