Home / mailings APPLE-SA-2012-09-17-1 Apple Remote Desktop 3.5.3
Posted on 18 September 2012
Apple Security-announce-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2012-09-17-1 Apple Remote Desktop 3.5.3
Apple Remote Desktop 3.5.3 is now available and addresses the
following:
Apple Remote Desktop
Available for: Apple Remote Desktop 3.0 or later
Impact: Connecting to a third-party VNC server with "Encrypt all
network data" set may lead to information disclosure
Description: When connecting to a third-party VNC server with
"Encrypt all network data" set, data is not encrypted and no warning
is produced. This issue is addressed by creating an SSH tunnel for
the VNC connection in this configuration, and preventing the
connection if the SSH tunnel cannot be created. This issue does not
affect Apple Remote Desktop 3.5.1 and earlier.
CVE-ID
CVE-2012-0681 : Mark S. C. Smith studying at Central Connecticut
State University
Apple Remote Desktop 3.5.3 may be obtained from the Software Update
pane in System Preferences, or Apple's Software Downloads web site:
http://www.apple.com/support/downloads/
The download file is named: "RemoteDesktopAdmin353.dmg"
Its SHA-1 digest is: 7fd3a92dcd0e495e94a575bd09b333a89049c877
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
