Apple Mac OS X Server Manager Authentication Bypass Security Vulnerability

Bugtraq ID:	33813
Class:	Design Error
CVE:	CVE-2009-0138
Remote:	Yes
Local:	No
Published:	Feb 12 2009 12:00AM
Updated:	Feb 18 2009 03:47PM
Credit:	Apple
Vulnerable:	Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5
Not Vulnerable:

Apple Mac OS X Server Manager Authentication Bypass Security Vulnerability

Apple Mac OS X is prone to an authentication-bypass vulnerability.

A remote attacker may exploit this issue to connect to the Server Manager without proper authorization. This will allow the attacker to alter the configuration of the affected system, which may aid in further attacks.

The issue affects Mac OS X v10.5.6 and Mac OS X Server v10.5.6.

NOTE: This issue was previously covered in BID 33759 (Apple Mac OS X 2009-001 Multiple Security Vulnerabilities), but has been assigned its own record to better document it.

Apple Mac OS X Server Manager Authentication Bypass Security Vulnerability

An attacker can use system utilities to carry out this attack.

Apple Mac OS X Server Manager Authentication Bypass Security Vulnerability

Solution:
The vendor has released an advisory and updates to address this issue. Please see the references for more information.


Apple Mac OS X Server 10.5.6

• Apple SecUpdSrvr2009-001.dmg
  http://support.apple.com/downloads/Security_Update_2009_001__Server_Le opard_

Apple Mac OS X 10.5.6

• Apple SecUpd2009-001.dmg
  http://support.apple.com/downloads/Security_Update_2009_001__Leopard_

Apple Mac OS X Server Manager Authentication Bypass Security Vulnerability

References:

• About the security content of Security Update 2009-001 (Apple)
  
• Mac OS X Homepage (Apple)