CVE-2006-4887

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-09-19 · updated 2026-06-16

Description

Apple Remote Desktop (ARD) for Mac OS X 10.2.8 and later does not drop privileges on the remote machine while installing certain applications, which allows local users to bypass authentication and gain privileges by selecting the icon during installation. NOTE: it could be argued that the issue is not in Remote Desktop itself, but in applications that are installed while using it.

Affected products

Apple Remote Desktop: 2.0.0, 2.1.0, 3.0.0
macOS: through 10.2.8

References

http://www.osvdb.org/32260
http://www.securityfocus.com/archive/1/446371/100/0/threaded
http://www.securityfocus.com/archive/1/446751/100/0/threaded
http://www.securityfocus.com/archive/1/447043/100/0/threaded
http://www.securityfocus.com/bid/20092
https://exchange.xforce.ibmcloud.com/vulnerabilities/29060
http://www.osvdb.org/32260
http://www.securityfocus.com/archive/1/446371/100/0/threaded
http://www.securityfocus.com/archive/1/446751/100/0/threaded
http://www.securityfocus.com/archive/1/447043/100/0/threaded
http://www.securityfocus.com/bid/20092
https://exchange.xforce.ibmcloud.com/vulnerabilities/29060

Get alerted when CVE-2006-4887 or the next vulnerability affects your stack