OSVDB ID: 29270 Title: Apple Mac OS X LoginWindow Arbitrary Kerberos Ticket Disclosure |
Info |
|
|
Dates |
||||
|
|
Description |
Mac OS X contains a flaw that may allow a malicious local user to access the Kerberos ticket of another user. The issue is triggered when a user unsuccessfully attempts to log in to a network account via loginwindow, and the Kerberos ticket is not destroyed. It is possible that the flaw may allow arbitrary access to credentials resulting in a loss of confidentiality. |
Classification |
Location:
Local Access Required
Attack Type: Authentication Management, Cryptographic Impact: Loss of Confidentiality Exploit: Exploit Unknown Disclosure: OSVDB Verified, Vendor Verified |
Solution |
Currently, there are no known workarounds or upgrades to correct this issue. However, Apple has released a patch to address this vulnerability. |
Products |
|
References |
Credit |
|