PT-2007-2189 · Apple · Macos X

Published 2007-04-24 · Updated 2011-03-08 · CVE-2007-0738

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions 10.4 through 10.4.9

Description The issue concerns the Login Window in Apple Mac OS X, where the screen saver authentication dialog is not displayed under certain conditions when the computer wakes from sleep. This occurs despite the option to require a password to wake the computer from sleep being enabled, allowing local users to bypass authentication controls.

Recommendations For Apple Mac OS X versions 10.4 through 10.4.9, consider disabling the sleep function or setting the computer to never sleep to minimize the risk of exploitation until a fix is available. As a temporary workaround, ensure that physical access to the computer is restricted to authorized personnel.

Fix

Related Identifiers

CVE-2007-0738

Affected Products

Macos X

References · 9

• http://securityfocus.com/bid/23569 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-0738 · Security Note
• http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html · Vendor Advisory
• http://securitytracker.com/id?1017939 · Note
• http://us-cert.gov/cas/techalerts/TA07-109A.html · Note
• http://secunia.com/advisories/24966 · Note
• http://vupen.com/english/advisories/2007/1470 · Note
• http://osvdb.org/34863 · Note
• http://docs.info.apple.com/article.html?artnum=305391 · Note