Vulnerability Note VU#847468

Apple Workgroup Manager fails to properly enable ShadowHash passwords

Overview

Apple Workgroup Manager fails to properly enable ShadowHash passwords in a NetInfo parent. Workgroup Manager may appear to use ShadowHash passwords when crypt is used.

I. Description

Workgroup Manager is a system adimistration tool in Apple Mac OS X Server that manages users, groups, and computers across a network. According to Apple Security Update 2006-006:

Workgroup Manager appears to allow switching authentication type from crypt to ShadowHash passwords in a NetInfo parent, when in actuality it does not.

This issue can be easily detected by refreshing the view of an account in a NetInfo parent.

II. Impact

Workgroup Manager may appear to use ShadowHash passwords when crypt is used.

III. Solution

Upgrade

Apple has addressed this issue in Apple Security Update 2006-006.

Systems Affected

Vendor	Status	Date Updated
Apple Computer, Inc.	Vulnerable	2-Oct-2006

References

http://secunia.com/advisories/22187/
http://docs.info.apple.com/article.html?artnum=304460

Credit

This issue was reported in Apple Security Update 2006-006. Apple credits Chris Pepper of The Rockefeller University for reporting this issue.

This document was written by Chris Taschner.

Other Information

Date Public	09/29/2006
Date First Published	10/02/2006 03:09:27 PM
Date Last Updated	11/21/2006
CERT Advisory
CVE Name	CVE-2006-4399
Metric	0.00
Document Revision	10

If you have feedback, comments, or additional information about this vulnerability, please send us email.