CVE-2012-0681 Weak cryptography in n/a
Attackers can sniff cleartext VNC session data when connecting to third-party servers, bypassing encryption settings in Apple Remote Desktop.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-0681?
CVE-2012-0681 is a medium-severity vulnerability in n/a, published on 22 Aug 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apple Remote Desktop before 3.6.1 does not recognize the "Encrypt all network data" setting during connections to third-party VNC servers, which allows remote attackers to obtain cleartext VNC session content by sniffing the network.
Weakness: CWE-310
Which versions are affected by CVE-2012-0681?
It affects 1 product.
Products include Apple Apple Remote Desktop.
How do I fix CVE-2012-0681?
No fix has been published for CVE-2012-0681 yet. Limit exposure of the affected software until one is available.
Is CVE-2012-0681 being exploited?
There is no known exploitation of CVE-2012-0681 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-5j5w-v5qv-67gx.