Improper Authentication in Apple MAC OS X



Published: 2012-09-21 | Updated: 2020-08-11
Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2012-3721
CWE-ID CWE-287
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		macOS
Operating systems & Components / Operating system

Vendor Apple Inc.

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Improper Authentication

EUVDB-ID: #VU43489

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2012-3721

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Profile Manager in Apple Mac OS X before 10.7.5 does not properly perform authentication for the Device Management private interface, which allows attackers to enumerate managed devices via unspecified vectors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

macOS: 10.0 - 10.7.3

External links

http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
http://support.apple.com/kb/HT5501
http://exchange.xforce.ibmcloud.com/vulnerabilities/78746


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###