BID:32880

Apple Mac OS X Managed Client Screen Saver Lock Bypass Vulnerability

Info

Apple Mac OS X Managed Client Screen Saver Lock Bypass Vulnerability

Bugtraq ID:	32880
Class:	Design Error
CVE:	CVE-2008-4237
Remote:	No
Local:	Yes
Published:	Dec 15 2008 12:00AM
Updated:	Dec 17 2008 09:41PM
Credit:	John Barnes of ESRI and Trevor Lalish-Menagh of Tamman Technologies, Inc.
Vulnerable:	Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5

Not Vulnerable:	Apple Mac OS X Server 10.5.6 Apple Mac OS X 10.5.6

Discussion

Apple Mac OS X Managed Client Screen Saver Lock Bypass Vulnerability

Apple Mac OS X is prone to a security-bypass vulnerability affecting managed client systems.

An attacker with physical access to affected computers may take advantage of this issue to bypass expected security measures. This may allow the attacker to obtain sensitive information or may aid in further attacks.

NOTE: This issue was previously covered in BID 32839 (Apple Mac OS X 2008-008 Multiple Security Vulnerabilities), but has been given its own record to better document the issue.

This issue affects Mac OS X 10.5 through 10.5.5 and Server 10.5 through 10.5.5.

Exploit / POC

Apple Mac OS X Managed Client Screen Saver Lock Bypass Vulnerability

No exploit is required.

Solution / Fix

Apple Mac OS X Managed Client Screen Saver Lock Bypass Vulnerability

Solution:
The vendor has released an advisory and updates to address these issues. Please see the references for more information.

Apple Mac OS X 10.5