Apple patched a vulnerability in its remote desktop product where the connection isn’t being encrypted correctly. This may result in information disclosure, Apple said in its advisory.
Even if the user had “Encrypt all network data” selected, connecting to athird-party VNC server may result in “information disclosure” because data is not encrypted, according to a security advisory posted on the Apple website Aug. 20. The vulnerability does not affect Remote Desktop versions 3.5.1 and earlier, and version 3.6.1 is now available from the Mac App Store or Apple’s Software Update Pane, or Apple’s Software Downloads web site.
[The download file is named “RemoteDesktopAdmin361.dmg” and its SHA-1 digest is: dd41bab369c7905e79ff3b3adea97904f55d9759]
The bug is a serious flaw because users don’t see any warnings that the data is not being encrypted. Not knowing the data is exposed, they may send sensitive information that can be intercepted and used maliciously. The vulnerability was addressed by adding an SSH tunnel to the connection to wrap all communications within the encrypted tunnel, Apple said.
Mark S. C. Smith, at Central Connecticut State University, was credited the discovering the flaw.
More from Fahmida Y. Rashid
- Emissary Panda Hackers Get Selective in Data Heists
- Financial Firms Embrace Cloud With Encryption, Tokenization: Report
- United Airlines Hack Highlights Need for Improved Information Sharing
- CISOs Challenged in C-Suite: Report
- Cyber Attack on Power Grid Could Top $1 Trillion in Damage: Report
- Dyre Malware Gang Targets Spanish Banks
- Ex-employees Have “Easy” Access to Corporate Data: Survey
- Leaked Government Credentials Abundant on Public Web
Latest News
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- Zyxel Firewalls Hacked by Mirai Botnet
- Watch Now: Threat Detection and Incident Response Virtual Summit
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
