macOS 10.15.x < 10.15.5 / 10.14.x < 10.14.6 Security Update 2020-003 / 10.13.x < 10.13.6 Security Update 2020-003 - Nessus
High Plugin ID: 136930This page contains detailed information about the macOS 10.15.x < 10.15.5 / 10.14.x < 10.14.6 Security Update 2020-003 / 10.13.x < 10.13.6 Security Update 2020-003 Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.
Plugin Overview
ID: 136930
Name: macOS 10.15.x < 10.15.5 / 10.14.x < 10.14.6 Security Update 2020-003 / 10.13.x < 10.13.6 Security Update 2020-003
Filename: macos_HT211170.nasl
Vulnerability Published: 2020-02-24
This Plugin Published: 2020-05-28
Last Modification Time: 2021-03-19
Plugin Version: 1.9
Plugin Type: combined
Plugin Family: MacOS X Local Security Checks
Dependencies:
os_fingerprint.nasl, ssh_get_info.nasl
Vulnerability Information
Severity: High
Vulnerability Published: 2020-02-24
Patch Published: 2020-05-18
CVE [?]: CVE-2019-14868, CVE-2019-20044, CVE-2020-3878, CVE-2020-3882, CVE-2020-9771, CVE-2020-9772, CVE-2020-9788, CVE-2020-9789, CVE-2020-9790, CVE-2020-9791, CVE-2020-9792, CVE-2020-9793, CVE-2020-9794, CVE-2020-9795, CVE-2020-9797, CVE-2020-9804, CVE-2020-9808, CVE-2020-9809, CVE-2020-9811, CVE-2020-9812, CVE-2020-9813, CVE-2020-9814, CVE-2020-9815, CVE-2020-9816, CVE-2020-9817, CVE-2020-9821, CVE-2020-9822, CVE-2020-9824, CVE-2020-9825, CVE-2020-9826, CVE-2020-9827, CVE-2020-9828, CVE-2020-9830, CVE-2020-9831, CVE-2020-9832, CVE-2020-9833, CVE-2020-9834, CVE-2020-9837, CVE-2020-9839, CVE-2020-9841, CVE-2020-9842, CVE-2020-9844, CVE-2020-9847, CVE-2020-9851, CVE-2020-9852, CVE-2020-9855, CVE-2020-9856, CVE-2020-9857
CPE [?]: cpe:/o:apple:macos, cpe:/o:apple:mac_os_x
Exploited by Malware: True
Synopsis
The remote host is missing a macOS update that fixes multiple vulnerabilities
Description
The remote host is running a version of macOS / Mac OS X that is 10.15.x prior to 10.15.5, 10.13.x prior to 10.13.6 Security Update 2020-003, 10.14.x prior to 10.14.6 Security Update 2020-003. It is, therefore, affected by multiple vulnerabilities:
- In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely. (CVE-2019-14868)
- In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid(). (CVE-2019-20044)
- An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. Processing a maliciously crafted image may lead to arbitrary code execution. (CVE-2020-3878)
Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.
Solution
Upgrade to macOS 10.15.5 / 10.14.x < 10.14.6 Security Update 2020-003 / 10.13.x < 10.13.6 Security Update 2020-003 or later
Public Exploits
Target Network Port(s): N/A
Target Asset(s): Host/MacOSX/Version, Host/OS
Exploit Available: True (Metasploit Framework, GitHub)
Exploit Ease: Exploits are available
Here's the list of publicly known exploits and PoCs for verifying the macOS 10.15.x < 10.15.5 / 10.14.x < 10.14.6 Security Update 2020-003 / 10.13.x < 10.13.6 Security Update 2020-003 vulnerability:
- Metasploit: exploit/osx/browser/safari_in_operator_side_effect
[Safari in Operator Side Effect Exploit] - Metasploit: exploit/osx/local/cfprefsd_race_condition
[macOS cfprefsd Arbitrary File Write Local Privilege Escalation] - GitHub: https://research.nccgroup.com/2020/05/28/exploring-macos-calendar-alerts-part-2-exfiltrating-data-cve-2020-3882/
[CVE-2020-3882] - GitHub: https://github.com/amanszpapaya/MacPer
[CVE-2020-9771] - GitHub: https://github.com/houjingyi233/macOS-iOS-system-security
[CVE-2020-9771] - GitHub: https://github.com/dgardella/KCC
[CVE-2020-9794] - GitHub: https://github.com/dispera/giant-squid
[CVE-2020-9794] - GitHub: https://github.com/houjingyi233/macOS-iOS-system-security
[CVE-2020-9817] - GitHub: https://github.com/didi/kemon
[CVE-2020-9831] - GitHub: https://github.com/didi/kemon
[CVE-2020-9832] - GitHub: https://github.com/didi/kemon
[CVE-2020-9833] - GitHub: https://github.com/didi/kemon
[CVE-2020-9834]
Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.
WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.
Risk Information
CVSS Score Source [?]: CVE-2020-9852
CVSS V2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:H/RL:OF/RC:C
CVSS Base Score: | 9.3 (High) |
Impact Subscore: | 10.0 |
Exploitability Subscore: | 8.6 |
CVSS Temporal Score: | 8.1 (High) |
CVSS Environmental Score: | NA (None) |
Modified Impact Subscore: | NA |
Overall CVSS Score: | 8.1 (High) |
CVSS Base Score: | 7.8 (High) |
Impact Subscore: | 5.9 |
Exploitability Subscore: | 1.8 |
CVSS Temporal Score: | 7.5 (High) |
CVSS Environmental Score: | NA (None) |
Modified Impact Subscore: | NA |
Overall CVSS Score: | 7.5 (High) |
STIG Risk Rating: High
Go back to menu.
Plugin Source
This is the macos_HT211170.nasl nessus plugin source code. This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.
#
# (C) Tenable Network Security, Inc.
#
include('compat.inc');
if (description)
{
script_id(136930);
script_version("1.9");
script_set_attribute(attribute:"plugin_modification_date", value:"2021/03/19");
script_cve_id(
"CVE-2019-14868",
"CVE-2019-20044",
"CVE-2020-3878",
"CVE-2020-3882",
"CVE-2020-9771",
"CVE-2020-9772",
"CVE-2020-9788",
"CVE-2020-9789",
"CVE-2020-9790",
"CVE-2020-9791",
"CVE-2020-9792",
"CVE-2020-9793",
"CVE-2020-9794",
"CVE-2020-9795",
"CVE-2020-9797",
"CVE-2020-9804",
"CVE-2020-9808",
"CVE-2020-9809",
"CVE-2020-9811",
"CVE-2020-9812",
"CVE-2020-9813",
"CVE-2020-9814",
"CVE-2020-9815",
"CVE-2020-9816",
"CVE-2020-9817",
"CVE-2020-9821",
"CVE-2020-9822",
"CVE-2020-9824",
"CVE-2020-9825",
"CVE-2020-9826",
"CVE-2020-9827",
"CVE-2020-9828",
"CVE-2020-9830",
"CVE-2020-9831",
"CVE-2020-9832",
"CVE-2020-9833",
"CVE-2020-9834",
"CVE-2020-9837",
"CVE-2020-9839",
"CVE-2020-9841",
"CVE-2020-9842",
"CVE-2020-9844",
"CVE-2020-9847",
"CVE-2020-9851",
"CVE-2020-9852",
"CVE-2020-9855",
"CVE-2020-9856",
"CVE-2020-9857"
);
script_xref(name:"APPLE-SA", value:"APPLE-SA-2020-05-18");
script_xref(name:"APPLE-SA", value:"HT211170");
script_xref(name:"IAVA", value:"2020-A-0227-S");
script_name(english:"macOS 10.15.x < 10.15.5 / 10.14.x < 10.14.6 Security Update 2020-003 / 10.13.x < 10.13.6 Security Update 2020-003");
script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a macOS update that fixes multiple vulnerabilities");
script_set_attribute(attribute:"description", value:
"The remote host is running a version of macOS / Mac OS X that is 10.15.x prior to 10.15.5, 10.13.x prior to 10.13.6
Security Update 2020-003, 10.14.x prior to 10.14.6 Security Update 2020-003. It is, therefore, affected by multiple
vulnerabilities:
- In ksh version 20120801, a flaw was found in the way it
evaluates certain environment variables. An attacker
could use this flaw to override or bypass environment
restrictions to execute shell commands. Services and
applications that allow remote unauthenticated attackers
to provide one of those environment variables could
allow them to exploit this issue remotely.
(CVE-2019-14868)
- In Zsh before 5.8, attackers able to execute commands
can regain privileges dropped by the --no-PRIVILEGED
option. Zsh fails to overwrite the saved uid, so the
original privileges can be restored by executing
MODULE_PATH=/dir/with/module zmodload with a module that
calls setuid(). (CVE-2019-20044)
- An out-of-bounds read was addressed with improved input
validation. This issue is fixed in iOS 13.3.1 and iPadOS
13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS
6.1.2. Processing a maliciously crafted image may lead
to arbitrary code execution. (CVE-2020-3878)
Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported
version number.");
script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT211170");
script_set_attribute(attribute:"solution", value:
"Upgrade to macOS 10.15.5 / 10.14.x < 10.14.6 Security Update 2020-003 / 10.13.x < 10.13.6 Security Update 2020-003 or
later");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-9852");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"exploited_by_malware", value:"true");
script_set_attribute(attribute:"metasploit_name", value:'Safari in Operator Side Effect Exploit');
script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2020/02/24");
script_set_attribute(attribute:"patch_publication_date", value:"2020/05/18");
script_set_attribute(attribute:"plugin_publication_date", value:"2020/05/28");
script_set_attribute(attribute:"plugin_type", value:"combined");
script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x");
script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:macos");
script_set_attribute(attribute:"stig_severity", value:"I");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"MacOS X Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl", "os_fingerprint.nasl");
script_require_ports("Host/MacOSX/Version", "Host/OS");
exit(0);
}
include('vcf.inc');
include('lists.inc');
include('vcf_extras_apple.inc');
app_info = vcf::apple::macos::get_app_info();
constraints = [
{ 'max_version' : '10.15.4', 'min_version' : '10.15', 'fixed_build' : '19F96', 'fixed_display' : 'macOS Catalina 10.15.5' },
{ 'max_version' : '10.13.6', 'min_version' : '10.13', 'fixed_build' : '17G13033', 'fixed_display' : '10.13.6 Security Update 2020-003' },
{ 'max_version' : '10.14.6', 'min_version' : '10.14', 'fixed_build' : '18G5033', 'fixed_display' : '10.14.6 Security Update 2020-003' }
];
vcf::apple::macos::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);
The latest version of this script can be found in these locations depending on your platform:
- Linux / Unix:
/opt/nessus/lib/nessus/plugins/macos_HT211170.nasl
- Windows:
C:\ProgramData\Tenable\Nessus\nessus\plugins\macos_HT211170.nasl
- Mac OS X:
/Library/Nessus/run/lib/nessus/plugins/macos_HT211170.nasl
Go back to menu.
How to Run
Here is how to run the macOS 10.15.x < 10.15.5 / 10.14.x < 10.14.6 Security Update 2020-003 / 10.13.x < 10.13.6 Security Update 2020-003 as a standalone plugin via the Nessus web user interface (https://localhost:8834/):
- Click to start a New Scan.
- Select Advanced Scan.
- Navigate to the Plugins tab.
- On the top right corner click to Disable All plugins.
- On the left side table select MacOS X Local Security Checks plugin family.
- On the right side table select macOS 10.15.x < 10.15.5 / 10.14.x < 10.14.6 Security Update 2020-003 / 10.13.x < 10.13.6 Security Update 2020-003 plugin ID 136930.
- Specify the target on the Settings tab and click to Save the scan.
- Run the scan.
Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.
Basic usage:
/opt/nessus/bin/nasl macos_HT211170.nasl -t <IP/HOST>
Run the plugin with audit trail message on the console:
/opt/nessus/bin/nasl -a macos_HT211170.nasl -t <IP/HOST>
Run the plugin with trace script execution written to the console (useful for debugging):
/opt/nessus/bin/nasl -T - macos_HT211170.nasl -t <IP/HOST>
Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):
/opt/nessus/bin/nasl -K /tmp/state macos_HT211170.nasl -t <IP/HOST>
Go back to menu.
References
IAVA | Information Assurance Vulnerability Alert:
- 2020-A-0227-S
- HT211170, 2020-05-18
- https://www.tenable.com/plugins/nessus/136930
- https://support.apple.com/en-us/HT211170
- https://vulners.com/nessus/MACOS_HT211170.NASL
- 133528 - Apple iOS < 13.3.1 Multiple Vulnerabilities
- 136920 - Apple iOS < 13.5 Multiple Vulnerabilities
- 133727 - Apple TV < 13.3.1 Multiple Vulnerabilities
- 133531 - macOS 10.15.x < 10.15.3 / 10.14.x < 10.14.6 / 10.13.x < 10.13.6
Version
This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file macos_HT211170.nasl version 1.9. For more plugins, visit the Nessus Plugin Library.
Go back to menu.