Vulnerability Note VU#847468

Apple Workgroup Manager fails to properly enable ShadowHash passwords

Overview

Apple Workgroup Manager fails to properly enable ShadowHash passwords in a NetInfo parent. Workgroup Manager may appear to use ShadowHash passwords when crypt is used.

I. Description

Workgroup Manager is a system adimistration tool in Apple Mac OS X Server that manages users, groups, and computers across a network. According to Apple Security Update 2006-006:

Workgroup Manager appears to allow switching authentication type from crypt to ShadowHash passwords in a NetInfo parent, when in actuality it does not.

This issue can be easily detected by refreshing the view of an account in a NetInfo parent.

II. Impact

Workgroup Manager may appear to use ShadowHash passwords when crypt is used.

III. Solution

Upgrade

Apple has addressed this issue in Apple Security Update 2006-006.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Apple Computer, Inc.	Vulnerable	2-Oct-2006

References

http://secunia.com/advisories/22187/
http://docs.info.apple.com/article.html?artnum=304460

Credit

This issue was reported in Apple Security Update 2006-006. Apple credits Chris Pepper of The Rockefeller University for reporting this issue.

This document was written by Chris Taschner.

Other Information

Date Public:	2006-09-29
Date First Published:	2006-10-02
Date Last Updated:	2006-11-21
CERT Advisory:
CVE-ID(s):	CVE-2006-4399
NVD-ID(s):	CVE-2006-4399
US-CERT Technical Alerts:
Metric:	0.00
Document Revision:	10

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2006 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader