OSVDB ID: 27745 Title: Apple Mac OS X OpenSSH Nonexistent Account Login Enumeration DoS |
Info |
|
|
Dates |
||||
|
|
Description |
Mac OS X contains a flaw that may allow a remote denial of service. The issue is triggered when an attacker attempts to log in multiple times using a nonexistent account, which causes the process to hang, and will result in loss of availability for the service. This vulnerability could also be leveraged by an attacker to enumerate valid user accounts, resulting in a loss of confidentiality. |
Classification |
Location:
Remote / Network Access
Attack Type: Denial of Service, Information Disclosure Impact: Loss of Confidentiality, Loss of Availability Exploit: Exploit Public Disclosure: OSVDB Verified |
Solution |
Currently, there are no known workarounds or upgrades to correct this issue. However, Apple has released a patch (Security Update 2006-004) to address this vulnerability. |
Products |
|
References |
|
Credit |
|