CVEvulnerability
CVE-2008-3611
6.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-09-16
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.3 MEDIUM — AV:L/AC:M/Au:N/C:N/I:C/A:C
- Weaknesses
- CWE-287
Description
Login Window in Apple Mac OS X 10.4.11 does not clear the current password when a user makes a password-change attempt that is denied by policy, which allows opportunistic, physically proximate attackers to bypass authentication and change this user's password by later entering an acceptable new password on the same login screen.
Affected configurations
• apple mac os x 10.4.11
• apple mac os x server 10.4.11
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html lists.apple.com
- http://secunia.com/advisories/31882 Vendor Advisory
- http://securitytracker.com/id?1020878 securitytracker.com
- http://www.securityfocus.com/bid/31189 Patch
- http://www.us-cert.gov/cas/techalerts/TA08-260A.html US Government Resource
- http://www.vupen.com/english/advisories/2008/2584 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45171 exchange.xforce.ibmcloud.com
- http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html lists.apple.com
- http://secunia.com/advisories/31882 Vendor Advisory
- http://securitytracker.com/id?1020878 securitytracker.com
- http://www.securityfocus.com/bid/31189 Patch
- http://www.us-cert.gov/cas/techalerts/TA08-260A.html US Government Resource
- http://www.vupen.com/english/advisories/2008/2584 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45171 exchange.xforce.ibmcloud.com