PT-2012-2787 · Apple · Remote Desktop

Mark S. C. Smith · Published 2012-08-22 · Updated 2013-04-02 · CVE-2012-0681

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple Remote Desktop versions prior to 3.6.1

Description The issue allows remote attackers to obtain cleartext VNC session content by sniffing the network, due to the failure to recognize the "Encrypt all network data" setting during connections to third-party VNC servers.

Recommendations For Apple Remote Desktop versions prior to 3.6.1, update to version 3.6.1 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2012-0681

Affected Products

Remote Desktop

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2012-0681 · Security Note
• http://support.apple.com/kb/HT5433 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2012/Aug/msg00000.html · Vendor Advisory
• http://securityfocus.com/bid/55100 · Note