Format string vulnerability in Screen Sharing Server in Apple Mac OS X before 10.9 and Apple Remote Desktop before 3.5.4 allows remote attackers to execute arbitrary code via format string specifiers in a VNC username.

The remote host is running a version of Mac OS X that is older than 10.9 (dubbed OS X Maverick). The newer version contains numerous security-related fixes for the following components :

  - Application Firewall
  - App Sandbox
  - Bluetooth
  - CFNetwork
  - CFNetwork SSL
  - Console
  - CoreGraphics
  - curl
  - dyld
  - IOKitUser
  - IOSerialFamily
  - Kernel
  - Kext Management
  - LaunchServices
  - Libc
  - Mail Accounts
  - Mail Header Display
  - Mail Networking
  - OpenLDAP
  - perl
  - Power Management
  - python
  - ruby
  - Security
  - Security
  - Authorization
  - Security
  - Smart Card Services
  - Screen Lock
  - Screen Sharing Server
  - syslog
  - USB

According to its version, the Apple Remote Desktop install on the remote host is earlier than 3.5.4 / 3.7.  As such, it is potentially affected the following vulnerabilities :

  - A format string vulnerability exists in Remote     Desktop's handling of a VNC username. (CVE-2013-5135)

  - An information disclosure vulnerability exists because     Remote Desktop may use password authentication without     warning that the connection would be encrypted if a     third-party VNC server supports certain authentication     types. Note that this does not affect installs of     version 3.5.x or earlier. (CVE_2013-5136)

  - An authentication bypass vulnerability exists due to a     flaw in the full-screen feature that is triggered when     handling text entered in the dialog box upon recovering     from sleep mode with a remote connection alive. A local     attacker can exploit this to bypass intended access     restrictions. (CVE-2013-5229)

The remote host is running a version of Mac OS X 10.x that is prior to version 10.9. The newer version contains multiple security-related fixes for the following components :

  - Application Firewall
  - App Sandbox
  - Bluetooth
  - CFNetwork
  - CFNetwork SSL
  - Console
  - CoreGraphics
  - curl
  - dyld
  - IOKitUser
  - IOSerialFamily
  - Kernel
  - Kext Management
  - LaunchServices
  - Libc
  - Mail Accounts
  - Mail Header Display
  - Mail Networking
  - OpenLDAP
  - perl
  - Power Management
  - python
  - ruby
  - Security
  - Security - Authorization
  - Security - Smart Card Services
  - Screen Lock
  - Screen Sharing Server
  - syslog
  - USB

ID	Name	Product	Family	Severity
8040	Mac OS X < 10.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
70609	Apple Remote Desktop < 3.5.4 / 3.7 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
70561	Mac OS X 10.x < 10.9 Multiple Vulnerabilities (BEAST)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2013-5135

critical

Tenable Plugins

high

high

high