CVE-2016-4745

The Kerberos 5 aka krb5 PAM module in Apple OS X before 10.12 does not use constant-time operations for determining username validity, which makes it easier for remote attackers to enumerate user accounts via a timing side-channel attack...

CVE-2016-4745

The CVE-2016-4745 entry concerns the Kerberos 5 PAM module in Apple OS X prior to 10.12. The issue is that the PAM module does not use constant-time operations when determining username validity, enabling a timing side-channel that remote attackers could exploit to enumerate user accounts. The as...