Ensure Apple-provided Software Updates Are Installed

AltaNível 1Automatizadamacos

Descrição

Software vendors release security patches and software updates for their products when security vulnerabilities are discovered. There is no simple way to complete this action without a network connection to an Apple software repository. Please ensure appropriate access for this control. This check is only for what Apple provides through software update. Audit: Passes when LastFullSuccessfulDate is within 30 days and RecommendedUpdates lists no pending update.

Como é verificado

Método de auditoria: Comando shell

shell

[ -x /usr/bin/defaults ] || exit 1
d=$(/usr/bin/defaults read /Library/Preferences/com.apple.SoftwareUpdate LastFullSuccessfulDate 2>/dev/null) || { echo "never checked"; exit 0; }
t=$(/bin/date -j -f "%Y-%m-%d %H:%M:%S %z" "$d" +%s 2>/dev/null) || exit 1
now=$(/bin/date +%s)
[ $((now - t)) -le 2592000 ] || { echo "last successful check older than 30 days: $d"; exit 0; }
n=$(/usr/bin/defaults read /Library/Preferences/com.apple.SoftwareUpdate RecommendedUpdates 2>/dev/null | /usr/bin/grep -c "Product Key")
if [ "${n:-0}" -eq 0 ]; then echo compliant; else echo "updates pending: $n"; fi

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Terminal: sudo /usr/sbin/softwareupdate -l ; sudo /usr/sbin/softwareupdate -i -a ; sudo /usr/sbin/softwareupdate -i '<package name>'. GUI: System Settings > General > Software Update > Update All.

Propriedades

Sistemas operacionais: macos-26
Tags: macossoftware-update
Referência: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 1.1 Ensure Apple-provided Software Updates Are Installed

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target macos