certfr_avis - certa-2012-avi-456

CERTA-2012-AVI-456

Vulnerability from certfr_avis

Une vulnérabilité a été corrigée dans Apple Remote Desktop. Lors de la connexion à un serveur VNC tiers avec « Encrypt all network data » activé, les données ne sont en réalité pas chiffrées et aucune alerte n'est remontée.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Apple Remote Desktop 3.6.1 et antérieures.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Apple HT5433 du 20 août 2012	None	vendor-advisory
Bulletin de sécurité Apple HT5433 20 août 2012 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eApple Remote Desktop 3.6.1 et ant\u00e9rieures.\u003c/P\u003e",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-0681",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-0681"
    }
  ],
  "initial_release_date": "2012-08-22T00:00:00",
  "last_revision_date": "2012-08-22T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Apple HT5433 20 ao\u00fbt 2012 :",
      "url": "http://support.apple.com/kb/HT5433"
    }
  ],
  "reference": "CERTA-2012-AVI-456",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-08-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans \u003cspan class=\"textit\"\u003eApple Remote\nDesktop\u003c/span\u003e. Lors de la connexion \u00e0 un serveur \u003cspan\nclass=\"textit\"\u003eVNC\u003c/span\u003e tiers avec \u00ab Encrypt all network data \u00bb\nactiv\u00e9, les donn\u00e9es ne sont en r\u00e9alit\u00e9 pas chiffr\u00e9es et aucune alerte\nn\u0027est remont\u00e9e.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apple Remote Desktop",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apple HT5433 du 20 ao\u00fbt 2012",
      "url": null
    }
  ]
}

CVE-2012-0681 (GCVE-0-2012-0681)

Vulnerability from cvelistv5

Published

2012-08-22 10:00

Modified

2024-08-06 18:30

Severity ?

CWE

Summary

Apple Remote Desktop before 3.6.1 does not recognize the "Encrypt all network data" setting during connections to third-party VNC servers, which allows remote attackers to obtain cleartext VNC session content by sniffing the network.

References

URL

Tags

	http://www.securityfocus.com/bid/55100	vdb-entry, x_refsource_BID
	http://lists.apple.com/archives/security-announce/2012/Aug/msg00000.html	vendor-advisory, x_refsource_APPLE
	http://support.apple.com/kb/HT5433	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:30:53.902Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "55100",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/55100"
          },
          {
            "name": "APPLE-SA-2012-08-20-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2012/Aug/msg00000.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT5433"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-08-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apple Remote Desktop before 3.6.1 does not recognize the \"Encrypt all network data\" setting during connections to third-party VNC servers, which allows remote attackers to obtain cleartext VNC session content by sniffing the network."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2013-03-30T09:00:00.000Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "name": "55100",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/55100"
        },
        {
          "name": "APPLE-SA-2012-08-20-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2012/Aug/msg00000.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT5433"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-security@apple.com",
          "ID": "CVE-2012-0681",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Apple Remote Desktop before 3.6.1 does not recognize the \"Encrypt all network data\" setting during connections to third-party VNC servers, which allows remote attackers to obtain cleartext VNC session content by sniffing the network."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "55100",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/55100"
            },
            {
              "name": "APPLE-SA-2012-08-20-1",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2012/Aug/msg00000.html"
            },
            {
              "name": "http://support.apple.com/kb/HT5433",
              "refsource": "CONFIRM",
              "url": "http://support.apple.com/kb/HT5433"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2012-0681",
    "datePublished": "2012-08-22T10:00:00.000Z",
    "dateReserved": "2012-01-12T00:00:00.000Z",
    "dateUpdated": "2024-08-06T18:30:53.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTA-2012-AVI-456

Vulnerability from certfr_avis

Solution

CVE-2012-0681 (GCVE-0-2012-0681)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature