Description
Race condition in Login Window in Apple Mac OS X 10.5 through 10.5.4, when a blank-password account is enabled, allows attackers to bypass password authentication and login to any account via multiple attempts to login to the blank-password account, followed by selection of an arbitrary account from the user list.
References
- 31189 vdb-entry
- macos-login-window-security-bypass(45170) vdb-entry
- APPLE-SA-2008-09-15 vendor-advisory
- TA08-260A third-party-advisory
- 1020878 vdb-entry
- ADV-2008-2584 vdb-entry
- 31882 third-party-advisory