PT-2006-2447 · Apple · Appkit+1

Published 2006-05-12 · Updated 2017-07-20 · CVE-2006-1439

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions AppKit in Apple Mac OS X version 10.4.6

Description The issue concerns NSSecureTextField in AppKit, which fails to re-enable secure event input under certain circumstances. This could allow other applications in the same window session to monitor input characters and keyboard events.

Recommendations For AppKit in Apple Mac OS X version 10.4.6, consider applying configuration changes to restrict access to sensitive input fields until a fix is available. As a temporary workaround, avoid using NSSecureTextField in applications where secure input is crucial, to minimize the risk of input character and keyboard event monitoring.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2006-1439

Affected Products

Appkit

Macos X

References · 8

• http://secunia.com/advisories/20077 · Vendor Advisory
• http://vupen.com/english/advisories/2006/1779 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1439 · Security Note
• http://lists.apple.com/archives/security-announce/2006/May/msg00003.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26404 · Note
• http://osvdb.org/25583 · Note
• http://securityfocus.com/bid/17951 · Note
• http://us-cert.gov/cas/techalerts/TA06-132A.html · Note