BID:43341

Apple Mac OS X AFP Server Password Validation Security Bypass Vulnerability

Info

Apple Mac OS X AFP Server Password Validation Security Bypass Vulnerability

Bugtraq ID:	43341
Class:	Access Validation Error
CVE:	CVE-2010-1820
Remote:	Yes
Local:	No
Published:	Sep 20 2010 12:00AM
Updated:	Sep 20 2010 12:00AM
Credit:	Apple
Vulnerable:	Apple Mac OS X Server 10.6.4 Apple Mac OS X Server 10.6.3 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.6 Apple Mac OS X 10.6.4 Apple Mac OS X 10.6.3 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac OS X 10.6

Not Vulnerable:

Discussion

Apple Mac OS X AFP Server Password Validation Security Bypass Vulnerability

Apple Mac OS X is prone to a security-bypass vulnerability that affects Apple Filing Protocol (AFP) Server.

Remote attackers with knowledge of an account name on a target computer can exploit this issue to access AFP shared folders.

The following are affected:

Mac OS X 10.6 through 10.6.4
Mac OS X Server 10.6 through 10.6.4

Exploit / POC

Apple Mac OS X AFP Server Password Validation Security Bypass Vulnerability

Attackers require knowledge of an account name on a target system to exploit this issue.

Solution / Fix

Apple Mac OS X AFP Server Password Validation Security Bypass Vulnerability

Solution:
Updates are available; please see the references for more information.

Apple Mac OS X 10.6