CVE-2008-3611
At a glance
- Source
- NVD
- EPSS
- EPSS 0.36 % · percentile 29 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
Login Window in Apple Mac OS X 10.4.11 does not clear the current password when a user makes a password-change attempt that is denied by policy, which allows opportunistic, physically proximate attackers to bypass authentication and change this user's password by later entering an acceptable new password on the same login screen.
Weaknesses (CWE)
- CWE-287 — Improper Authentication
References
- http://www.securityfocus.com/bid/31189
- http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html
- http://www.us-cert.gov/cas/techalerts/TA08-260A.html
- http://securitytracker.com/id?1020878
- http://www.vupen.com/english/advisories/2008/2584
- http://secunia.com/advisories/31882
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45171
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 6.3 | AV:L/AC:M/Au:N/C:N/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2008-3597
- GCVE · GCVE-0-2008-3611
CERT-FR advisories
- CERTA-2008-AVI-463 — Multiples vulnérabilités dans MacOSX · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:apple:mac_os_x:10.4.11:*:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x_server:10.4.11:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |