CVE-2006-4887 — Apple MAC OS X vulnerability

3 documents3 sources
Severity
7.2HIGHNVD
EPSS
0.1%
top 74.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apple MAC OS XApple Remote Desktop
Timeline
PublishedSep 19
Latest updateMay 1

Description

Apple Remote Desktop (ARD) for Mac OS X 10.2.8 and later does not drop privileges on the remote machine while installing certain applications, which allows local users to bypass authentication and gain privileges by selecting the icon during installation. NOTE: it could be argued that the issue is not in Remote Desktop itself, but in applications that are installed while using it.

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0

Affected Packages2 packages

▶NVDapple/apple_remote_desktop2.0.0, 2.1.0, 3.0.0+2
▶NVDapple/mac_os_x10.2.8

🔴Vulnerability Details

2
GHSA
GHSA-3j35-f44c-3fcg: Apple Remote Desktop (ARD) for Mac OS X 10↗2022-05-01
▶
CVEList
CVE-2006-4887: Apple Remote Desktop (ARD) for Mac OS X 10↗2006-09-19
▶
CVE-2006-4887 — Apple MAC OS X vulnerability | cvebase