{"id":176,"date":"2008-06-27T08:31:13","date_gmt":"2008-06-27T07:31:13","guid":{"rendered":"http:\/\/blog.intego.com\/?p=176"},"modified":"2008-06-27T08:31:13","modified_gmt":"2008-06-27T07:31:13","slug":"under-the-hood-the-ardagent-vulnerability","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/","title":{"rendered":"Under The Hood: The ARDAgent Vulnerability"},"content":{"rendered":"<p><img src=\"https:\/\/www.intego.com\/mac-security-blog\/images\/ardicon.jpg\" alt=\"\" \/><\/p>\n<p>We <a href=\"https:\/\/www.intego.com\/mac-security-blog\/new-critical-threat-to-mac-os-x\/\">recently wrote about a critical threat to Mac OS X<\/a> which allows malicious programs to execute code as root when run locally, or via a remote connection, on computers running Mac OS X 10.4 and 10.5. This vulnerability exploits a flaw in ARDAgent, an application that allows remote users to legitimately control Macs using Apple Remote Desktop software. (This is used in schools, labs and businesses by administrators who manage multiple Macs.)  Rob Griffiths, <a href=\"http:\/\/www.macworld.com\/article\/134165\/2008\/06\/ardagent.html\">writing at Macworld<\/a>, gives an under-the-hood look at exactly how this vulnerability works and what the implications are. <\/p>\n<p>We&#8217;re still waiting for word from Apple about this vulnerability, which has been universally criticized, and which remains a critical threat. In the meantime, <a href=\"https:\/\/www.intego.com\/virusbarrier\/\">Intego VirusBarrier<\/a> has updated its virus definitions several times to protect against Trojan horses that exploit this flaw. Keep your copy of VirusBarrier up to date so you can ensure your Mac is protected. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>We recently wrote about a critical threat to Mac OS X which allows malicious programs to execute code as root when run locally, or via a remote connection, on computers running Mac OS X 10.4 and 10.5. This vulnerability exploits a flaw in ARDAgent, an application that allows remote users to legitimately control Macs using [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[7,13],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v17.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<meta name=\"description\" content=\"We recently wrote about a critical threat to Mac OS X which allows malicious programs to execute code as root when run locally, or via a remote\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Under The Hood: The ARDAgent Vulnerability - The Mac Security Blog\" \/>\n<meta property=\"og:description\" content=\"We recently wrote about a critical threat to Mac OS X which allows malicious programs to execute code as root when run locally, or via a remote\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/\" \/>\n<meta property=\"og:site_name\" content=\"The Mac Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2008-06-27T07:31:13+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.intego.com\/mac-security-blog\/images\/ardicon.jpg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Peter James\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\",\"name\":\"Intego\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/\",\"sameAs\":[],\"logo\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#logo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png\",\"contentUrl\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png\",\"width\":875,\"height\":875,\"caption\":\"Intego\"},\"image\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#logo\"}},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#website\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/\",\"name\":\"The Mac Security Blog\",\"description\":\"Keep Macs safe from the dangers of the Internet\",\"publisher\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.intego.com\/mac-security-blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/#primaryimage\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/images\/ardicon.jpg\",\"contentUrl\":\"https:\/\/www.intego.com\/mac-security-blog\/images\/ardicon.jpg\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/#webpage\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/\",\"name\":\"Under The Hood: The ARDAgent Vulnerability - The Mac Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/#primaryimage\"},\"datePublished\":\"2008-06-27T07:31:13+00:00\",\"dateModified\":\"2008-06-27T07:31:13+00:00\",\"description\":\"We recently wrote about a critical threat to Mac OS X which allows malicious programs to execute code as root when run locally, or via a remote\",\"breadcrumb\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.intego.com\/mac-security-blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Under The Hood: The ARDAgent Vulnerability\"}]},{\"@type\":\"Article\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/#webpage\"},\"author\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/d0c16bd0a4dd8f82d91204f400c8d116\"},\"headline\":\"Under The Hood: The ARDAgent Vulnerability\",\"datePublished\":\"2008-06-27T07:31:13+00:00\",\"dateModified\":\"2008-06-27T07:31:13+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/#webpage\"},\"wordCount\":155,\"publisher\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.intego.com\/mac-security-blog\/images\/ardicon.jpg\",\"articleSection\":[\"Apple\",\"Security &amp; Privacy\"],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/d0c16bd0a4dd8f82d91204f400c8d116\",\"name\":\"Peter James\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#personlogo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/0626bfb4ada576ba5aa775322329ad47?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/0626bfb4ada576ba5aa775322329ad47?s=96&d=mm&r=g\",\"caption\":\"Peter James\"},\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/author\/peter\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"description":"We recently wrote about a critical threat to Mac OS X which allows malicious programs to execute code as root when run locally, or via a remote","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/","og_locale":"en_US","og_type":"article","og_title":"Under The Hood: The ARDAgent Vulnerability - The Mac Security Blog","og_description":"We recently wrote about a critical threat to Mac OS X which allows malicious programs to execute code as root when run locally, or via a remote","og_url":"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/","og_site_name":"The Mac Security Blog","article_published_time":"2008-06-27T07:31:13+00:00","og_image":[{"url":"https:\/\/www.intego.com\/mac-security-blog\/images\/ardicon.jpg"}],"twitter_card":"summary_large_image","twitter_misc":{"Written by":"Peter James","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Organization","@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization","name":"Intego","url":"https:\/\/www.intego.com\/mac-security-blog\/","sameAs":[],"logo":{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/#logo","inLanguage":"en-US","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png","contentUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png","width":875,"height":875,"caption":"Intego"},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#logo"}},{"@type":"WebSite","@id":"https:\/\/www.intego.com\/mac-security-blog\/#website","url":"https:\/\/www.intego.com\/mac-security-blog\/","name":"The Mac Security Blog","description":"Keep Macs safe from the dangers of the Internet","publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intego.com\/mac-security-blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/#primaryimage","inLanguage":"en-US","url":"https:\/\/www.intego.com\/mac-security-blog\/images\/ardicon.jpg","contentUrl":"https:\/\/www.intego.com\/mac-security-blog\/images\/ardicon.jpg"},{"@type":"WebPage","@id":"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/#webpage","url":"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/","name":"Under The Hood: The ARDAgent Vulnerability - The Mac Security Blog","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/#primaryimage"},"datePublished":"2008-06-27T07:31:13+00:00","dateModified":"2008-06-27T07:31:13+00:00","description":"We recently wrote about a critical threat to Mac OS X which allows malicious programs to execute code as root when run locally, or via a remote","breadcrumb":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.intego.com\/mac-security-blog\/"},{"@type":"ListItem","position":2,"name":"Under The Hood: The ARDAgent Vulnerability"}]},{"@type":"Article","@id":"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/#article","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/#webpage"},"author":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/d0c16bd0a4dd8f82d91204f400c8d116"},"headline":"Under The Hood: The ARDAgent Vulnerability","datePublished":"2008-06-27T07:31:13+00:00","dateModified":"2008-06-27T07:31:13+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/#webpage"},"wordCount":155,"publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/under-the-hood-the-ardagent-vulnerability\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intego.com\/mac-security-blog\/images\/ardicon.jpg","articleSection":["Apple","Security &amp; Privacy"],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/d0c16bd0a4dd8f82d91204f400c8d116","name":"Peter James","image":{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/#personlogo","inLanguage":"en-US","url":"https:\/\/secure.gravatar.com\/avatar\/0626bfb4ada576ba5aa775322329ad47?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/0626bfb4ada576ba5aa775322329ad47?s=96&d=mm&r=g","caption":"Peter James"},"url":"https:\/\/www.intego.com\/mac-security-blog\/author\/peter\/"}]}},"jetpack_featured_media_url":"","jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4VAYd-2Q","amp_enabled":true,"_links":{"self":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/176"}],"collection":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/comments?post=176"}],"version-history":[{"count":0,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/176\/revisions"}],"wp:attachment":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media?parent=176"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/categories?post=176"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/tags?post=176"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}