PT-2008-4987 · Apple · Macos X

Christopher A. Grande · Published 2008-09-16 · Updated 2017-08-08 · CVE-2008-3611

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Medium

Base vector

AV:L/AC:M/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mac OS X version 10.4.11

Description The issue arises when a user attempts to change their password, but the change is denied due to policy restrictions. In such cases, the current password is not cleared from the login window, allowing an attacker with physical access to the system to potentially bypass authentication. This could be exploited by an attacker entering a new, acceptable password on the same login screen, effectively changing the user's password without knowing the original password.

Recommendations For Mac OS X version 10.4.11, consider implementing a workaround to clear the password field after a failed password change attempt to prevent potential exploitation. However, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-3611

Affected Products

Macos X

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2008-3611 · Security Note
• http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html · Vendor Advisory
• http://secunia.com/advisories/31882 · Vendor Advisory
• http://securityfocus.com/bid/31189 · Patch
• http://vupen.com/english/advisories/2008/2584 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA08-260A.html · Note
• http://securitytracker.com/id?1020878 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45171 · Note