Apple OS X Profile Manager Device Management Private Interface Managed Device Enumeration

medium Nessus Plugin ID 65676

Language:

Synopsis

Apple Profile Manager provides the list of managed devices to unauthenticated clients.

Description

Profile Manager on Apple OS X Server before 10.7.5 does not properly perform authentication for the Device Management private interface, which allows attackers to enumerate managed devices via unspecified vectors.

Solution

Upgrade to Apple OS X Server 10.7.5 / 10.8.2 or later.

Plugin Details

Severity: Medium

ID: 65676

File Name: apple_profile_manager_anon_device_enum.nbin

Version: 1.87

Type: remote

Family: Mobile Devices

Published: 3/25/2013

Updated: 3/19/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 2.7

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: cpe:/o:apple:mac_os_x

Required KB Items: Host/Apple/profile_manager

Exploit Ease: No known exploits are available

Patch Publication Date: 9/19/2012

Vulnerability Publication Date: 9/19/2012

Reference Information

CVE: CVE-2012-3721

BID: 56247

APPLE-SA: APPLE-SA-2012-09-19-2

Detections

Analytics