First off: This is absolutely the wrong way to solve CSRF problems. CSRF vulnerabilities are a problem in your site, not in the browser. Blacklisting certain browsers is not going to solve your CSRF vulnerabilities. CSRF is not browser-specific and cannot be prevented through browser blacklisting.
Detecting browser versions: There are various ways to detect what browser version and plugin versions the user is using. For browser version, you can use the User Agent. For Flash, you can use the Flash player detection kit. For Java, see Sun's java update check. You'll want to check Quicktime, too, but I'm not sure how to do that. Note, however, that detection of the browser version and plugin versions is difficult in Internet Explorer.
Knowing which versions are insecure: Maintaining the list of known-vulnerable browser and plugin versions is more difficult. I think it's probably too much work to reasonably expect an ordinary site to maintain. For browsers, a partial starting point is Yahoo's list of A-grade browsers, but they don't maintain which version is the latest known-good version and which versions are known to have vulnerabilities.
Suggestions: If you must check for outdated/vulnerable browser and plugin versions, I suggest that you look closely at the Mozilla plugin check website, which checks whether you have any obsolete or vulnerable plugin version installed. It supports Firefox, Safari, Chrome, and Opera, and partially supports IE. You might want to copy or use their methods. See also Mozilla's JSON interface to their plugin version database.
Bottom-line recommendation: I think you're asking the wrong question. I think your question has some hidden assumptions and premises that are faulty. Browser blacklisting is not an effective way of fixing or mitigating CSRF vulnerabilities. And I think the question is unclear on the threat model. I suggest that you re-ask the question afresh, this time starting with the actual problem you are trying to solve and the constraints you are working within, rather than making assumptions about what the best solution is (e.g., assuming that browser blacklisting is the best solution).