PT-2021-8578 · Apple · Remote Desktop

Published 2021-12-23 · Updated 2022-01-07 · CVE-2017-2488

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple Remote Desktop versions prior to 3.9

Description A cryptographic weakness existed in the authentication protocol of Remote Desktop, allowing an attacker to potentially capture cleartext passwords. This issue was addressed by implementing the Secure Remote Password authentication protocol.

Recommendations For Apple Remote Desktop versions prior to 3.9, update to Apple Remote Desktop 3.9 to resolve the issue. As a temporary workaround, consider restricting access to Remote Desktop until the update is applied.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2017-2488

Affected Products

Remote Desktop

References · 4

• https://support.apple.com/en-us/HT207622 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2488 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2488 · Security Note
• https://t.me/cvenotify/25092 · Telegram Post