CVE-2008-3611
En bref
- Source
- NVD
- EPSS
- EPSS 0.36 % · centile 29 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Description
Login Window in Apple Mac OS X 10.4.11 does not clear the current password when a user makes a password-change attempt that is denied by policy, which allows opportunistic, physically proximate attackers to bypass authentication and change this user's password by later entering an acceptable new password on the same login screen.
Faiblesses (CWE)
- CWE-287 — Authentification incorrecte
Références
- http://www.securityfocus.com/bid/31189
- http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html
- http://www.us-cert.gov/cas/techalerts/TA08-260A.html
- http://securitytracker.com/id?1020878
- http://www.vupen.com/english/advisories/2008/2584
- http://secunia.com/advisories/31882
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45171
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 6.3 | AV:L/AC:M/Au:N/C:N/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2008-3597
- GCVE · GCVE-0-2008-3611
Avis du CERT-FR
- CERTA-2008-AVI-463 — Multiples vulnérabilités dans MacOSX · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:apple:mac_os_x:10.4.11:*:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x_server:10.4.11:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |