Vulnerability Note VU#371648

Apple Mac OS X ftpd may allow arbitrary users to determine account name validity

Overview

Apple Mac OS X ftpd may allow arbitrary users to determine account name validity. This vulnerability may reveal protected information or allow an attacker to cause a denial-of-service condition.

I. Description

According to Apple Security Update 2006-007:

When attempting to authenticate a valid user, the FTP server may crash during a failed login attempt. The crash does not occur when attempting to authenticate unknown users.

II. Impact

A remote, unauthenticated attacker may be able to determine protected information or cause a denial-of-service condition.

III. Solution

Apply Apple Updates

This issue is addressed by Apple Security Update 2006-007.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Apple Computer, Inc.	Vulnerable	29-Nov-2006

References

http://docs.info.apple.com/article.html?artnum=304829
http://secunia.com/advisories/23155/

Credit

This issue was reported in Apple Security Update 2006-007. Apple credits Benjamin Williams of the University of Canterbury for reporting this issue.

This document was written by Chris Taschner.

Other Information

Date Public:	2006-11-28
Date First Published:	2006-11-30
Date Last Updated:	2006-11-30
CERT Advisory:
CVE-ID(s):	CVE-2006-4403
NVD-ID(s):	CVE-2006-4403
US-CERT Technical Alerts:
Metric:	10.13
Document Revision:	8

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2006 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader