The remote host is running a version of macOS that is 10.12.x prior to 10.12.4. It is, therefore, affected by multiple vulnerabilities in multiple components, some of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these remote code execution vulnerabilities by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user. The affected components are as follows :

  - apache
  - apache_mod_php
  - AppleGraphicsPowerManagement
  - AppleRAID
  - Audio
  - Bluetooth
  - Carbon
  - CoreGraphics
  - CoreMedia
  - CoreText
  - curl
  - EFI
  - FinderKit
  - FontParser
  - HTTPProtocol
  - Hypervisor
  - iBooks
  - ImageIO
  - Intel Graphics Driver
  - IOATAFamily
  - IOFireWireAVC
  - IOFireWireFamily
  - Kernel
  - Keyboards
  - libarchive
  - libc++abi
  - LibreSSL
  - MCX Client
  - Menus
  - Multi-Touch
  - OpenSSH
  - OpenSSL
  - Printing
  - python
  - QuickTime
  - Security
  - SecurityFoundation
  - sudo
  - System Integrity Protection
  - tcpdump
  - tiffutil
  - WebKit

The version of Junos OS installed on the remote host is prior to 12.3X48-D55, 12.3R12-S13, 15.1X49-D100, 15.1F6-S12, 16.1R3-S4, 16.2R1-S4, 17.1R1-S2, or 17.2R1. It is, therefore, affected by a vulnerability as referenced in the JSA10940 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA11169 advisory.

  - Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote     attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
    (CVE-2016-10009)

  - sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets     as root, which might allow local users to gain privileges via unspecified vectors, related to     serverloop.c. (CVE-2016-10010)

  - authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer     contents, which might allow local users to obtain sensitive private-key information by leveraging access     to a privilege-separated child process. (CVE-2016-10011)

  - The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4     does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain     privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and     m_zlib data structures. (CVE-2016-10012)

  - sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference     and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c     and packet.c. (CVE-2016-10708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the remote pfSense install is affected by multiple vulnerabilities as stated in the referenced vendor advisories.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3538-1 advisory.

    Jann Horn discovered that OpenSSH incorrectly loaded PKCS#11 modules from untrusted directories. A remote     attacker could possibly use this issue to execute arbitrary PKCS#11 modules. This issue only affected     Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-10009)

    Jann Horn discovered that OpenSSH incorrectly handled permissions on Unix-domain sockets when privilege     separation is disabled. A local attacker could possibly use this issue to gain privileges. This issue only     affected Ubuntu 16.04 LTS. (CVE-2016-10010)

    Jann Horn discovered that OpenSSH incorrectly handled certain buffer memory operations. A local attacker     could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS     and Ubuntu 16.04 LTS. (CVE-2016-10011)

    Guido Vranken discovered that OpenSSH incorrectly handled certain shared memory manager operations. A     local attacker could possibly use issue to gain privileges. This issue only affected Ubuntu 14.04 LTS and     Ubuntu 16.04 LTS. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-10012)

    Michal Zalewski discovered that OpenSSH incorrectly prevented write operations in readonly mode. A remote     attacker could possibly use this issue to create zero-length files, leading to a denial of service.
    (CVE-2017-15906)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of Junos Space running on the remote device is < 18.2R1, and is therefore affected by multiple vulnerabilities:

  - Due to untrusted search path vulnerability in ssh-agent.c in ssh-agent     in OpenSSH before 7.4, unauthenticated, remote attacker can execute execute     arbitrary local PKCS#11 modules by leveraging control over a forwarded     agent-socket. (CVE-2016-10009)    
  - In OpenSSH before 7.4, an authenticated local attacker can escalate     privileges via unspecified vectors, related to serverloop.c.     (CVE-2016-10010)     
  - authfile.c in sshd in OpenSSH before 7.4 does not properly consider the     effects of realloc on buffer contents. an authenticated local attacker     can obtain sensitive private-key information by leveraging access to a     privilege-separated child process. (CVE-2016-10011)     
  - In sshd in OpenSSH before 7.4, a local attacker can gain privileges by     leveraging access to a sandboxed privilege-separation process due to a     bounds check that's enforced by all by the shared memory manager.     (CVE-2016-10012)     
  - The process_open function in sftp-server.c in OpenSSH before 7.6 does not     properly prevent write operations in readonly mode, which allows local     attackers to create zero-length files. (CVE-2017-15906)     
  - A reflected cross-site scripting vulnerability in OpenNMS included     with Juniper Networks Junos Space may allow the stealing of sensitive     information or session credentials from Junos Space administrators or     perform administrative actions.  (CVE-2018-0046)

This update for openssh fixes several issues.

These security issues were fixed :

  - CVE-2016-8858: The kex_input_kexinit function in kex.c     allowed remote attackers to cause a denial of service     (memory consumption) by sending many duplicate KEXINIT     requests (bsc#1005480).

  - CVE-2016-10012: The shared memory manager (associated     with pre-authentication compression) did not ensure that     a bounds check is enforced by all compilers, which might     allowed local users to gain privileges by leveraging     access to a sandboxed privilege-separation process,     related to the m_zback and m_zlib data structures     (bsc#1016370).

  - CVE-2016-10009: Untrusted search path vulnerability in     ssh-agent.c allowed remote attackers to execute     arbitrary local PKCS#11 modules by leveraging control     over a forwarded agent-socket (bsc#1016366).

  - CVE-2016-10010: When forwarding unix domain sockets with     privilege separation disabled, the resulting sockets     have be created as 'root' instead of the authenticated     user. Forwarding unix domain sockets without privilege     separation enabled is now rejected.

  - CVE-2016-10011: authfile.c in sshd did not properly     consider the effects of realloc on buffer contents,     which might allowed local users to obtain sensitive     private-key information by leveraging access to a     privilege-separated child process (bsc#1016369).

These non-security issues were fixed :

  - Adjusted suggested command for removing conflicting     server keys from the known_hosts file (bsc#1006221)

  - Properly verify CIDR masks in configuration (bsc#1005893     bsc#1021626)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
99134	macOS 10.12.x < 10.12.4 Multiple Vulnerabilities (httpoxy)	Nessus	MacOS X Local Security Checks	2017/3/31	2025/12/26	critical
130514	Juniper JSA10940	Nessus	Junos Local Security Checks	2019/11/6	2023/7/20	high
148681	Juniper Junos OS Multiple Vulnerabilities (JSA11169)	Nessus	Junos Local Security Checks	2021/4/15	2023/7/20	high
106503	pfSense < 2.3.3 Multiple Vulnerabilities (SA-17_01 - SA-17_03)	Nessus	Firewalls	2018/1/31	2019/11/8	critical
106266	Ubuntu 14.04 LTS / 16.04 LTS : OpenSSH vulnerabilities (USN-3538-1)	Nessus	Ubuntu Local Security Checks	2018/1/23	2025/9/3	high
126510	Juniper Junos Space < 18.2R1 Multiple Vulnerabilities (JSA10880)	Nessus	Junos Local Security Checks	2019/7/5	2022/5/19	high
96919	openSUSE Security Update : openssh (openSUSE-2017-184)	Nessus	SuSE Local Security Checks	2017/2/1	2026/1/2	high

检测

插件搜索

critical

high

high

critical

high

high

high