Mac OS X LoginWindow Network Account Access Bypass

2006-09-27T16:18:57
ID OSVDB:29272
Type osvdb
Reporter OSVDB
Modified 2006-09-27T16:18:57

Description

Vulnerability Description

Mac OS X contains a flaw that may allow a user to bypass login restrictions. The issue is triggered when controls are used to restrict which users are allowed to login via loginwindow, and network accounts without GUIDs are not subject to the restriction. It is possible that the flaw may allow unauthorized login resulting in a loss of integrity.

Solution Description

Currently, there are no known workarounds or upgrades to correct this issue. However, Apple has released a patch to address this vulnerability.

Short Description

Mac OS X contains a flaw that may allow a user to bypass login restrictions. The issue is triggered when controls are used to restrict which users are allowed to login via loginwindow, and network accounts without GUIDs are not subject to the restriction. It is possible that the flaw may allow unauthorized login resulting in a loss of integrity.

References:

Vendor Specific News/Changelog Entry: http://docs.info.apple.com/article.html?artnum=304460 Security Tracker: 1016959 Secunia Advisory ID:22187 Related OSVDB ID: 29268 Related OSVDB ID: 29273 Related OSVDB ID: 29270 Related OSVDB ID: 29276 Related OSVDB ID: 29269 Related OSVDB ID: 29267 Related OSVDB ID: 29271 Related OSVDB ID: 29274 Related OSVDB ID: 29275 ISS X-Force ID: 29293 FrSIRT Advisory: ADV-2006-3852 CVE-2006-4394 CERT VU: 897628 CERT: TA06-275A Bugtraq ID: 20271