Apple Mac OS X 'servermgrd' XML-RPC Request Information Disclosure Vulnerability

Bugtraq ID:	48445
Class:	Unknown
CVE:	CVE-2011-0212
Remote:	Yes
Local:	No
Published:	Jun 23 2011 12:00AM
Updated:	Mar 19 2015 08:13AM
Credit:	Apple
Vulnerable:	Apple Mac OS X Server 10.6.6 Apple Mac OS X Server 10.6.5 Apple Mac OS X Server 10.6.4 Apple Mac OS X Server 10.6.3 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.5.7 Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac Os X Server 10.6.7 Apple Mac OS X Server 10.6 Apple Mac OS X Server 10.5
Not Vulnerable:	Apple Mac Os X Server 10.6.8

Apple Mac OS X 'servermgrd' XML-RPC Request Information Disclosure Vulnerability

Apple Mac OS X is prone to an information-disclosure vulnerability in 'servermgrd'.

A remote attacker can exploit this issue to retrieve arbitrary files from the vulnerable computer. Information obtained may aid in further attacks.

NOTE: This issue was previously discussed in BID 48412 (Apple Mac OS X Prior to 10.6.8 Multiple Security Vulnerabilities) but has been given its own record to better document it.

Apple Mac OS X 'servermgrd' XML-RPC Request Information Disclosure Vulnerability

An attacker can exploit this issue by sending a specially crafted XML-RPC request to an affected computer.

Apple Mac OS X 'servermgrd' XML-RPC Request Information Disclosure Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.


Apple Mac OS X Server 10.6

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac Os X Server 10.6.7

• Apple MacOSXServerUpd10.6.8.dmg
  For Mac OS X Server v10.6.7
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.5.8

• Apple SecUpdSrvr2011-004.dmg
  For Mac OS X Server v10.5.8
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.1

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.2

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.3

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.4

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.5

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.6

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X 'servermgrd' XML-RPC Request Information Disclosure Vulnerability

References:

• Mac OS X Homepage (Apple)