PT-2006-5201 · Apple · Macos X

Patrick Gallagher · Published 2006-10-02 · Updated 2011-03-08 · CVE-2006-4397

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions 10.4 through 10.4.7

Description The issue is related to an unchecked error condition in the LoginWindow of Apple Mac OS X. This condition prevents Kerberos tickets from being destroyed if a user fails to log on to a network account from the login window. As a result, later users might be able to gain access to the original user's Kerberos tickets.

Recommendations For Apple Mac OS X versions 10.4 through 10.4.7, consider updating to a version outside of this range to mitigate the risk of unauthorized access to Kerberos tickets. As a temporary workaround, restrict access to sensitive network resources to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-4397

Affected Products

Macos X

References · 7

• http://securitytracker.com/id?1016959 · Patch
• http://secunia.com/advisories/22187 · Vendor Advisory
• http://securityfocus.com/bid/20271 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-4397 · Security Note
• http://osvdb.org/29270 · Note
• http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html · Patch, Vendor Advisory
• http://vupen.com/english/advisories/2006/3852 · Note