PT-2006-5641 · Apple · Remote Desktop

Published 2006-09-19 · Updated 2018-10-30 · CVE-2006-4887

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apple Remote Desktop versions 10.2.8 and later

Description The issue allows local users to bypass authentication and gain privileges by selecting the icon during installation of certain applications. This occurs because Apple Remote Desktop does not drop privileges on the remote machine while installing these applications.

Recommendations For Apple Remote Desktop versions 10.2.8 and later, consider restricting the installation of applications that require elevated privileges until a fix is available. As a temporary workaround, avoid selecting icons during installation to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-4887

Affected Products

Remote Desktop

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-4887 · Security Note
• http://securityfocus.com/archive/1/446371/100/0/threaded · Note
• http://osvdb.org/32260 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29060 · Note
• http://securityfocus.com/archive/1/447043/100/0/threaded · Note
• http://securityfocus.com/archive/1/446751/100/0/threaded · Note
• http://securityfocus.com/bid/20092 · Note