Description
The screensharing feature in the Admin application in Apple Xsan before 2.2 places a cleartext username and password in a URL within an error dialog, which allows physically proximate attackers to obtain credentials by reading this dialog.
References
- xsan-admin-information-disclosure(53232) vdb-entry
- 36385 vdb-entry
- 58133 vdb-entry
- ADV-2009-2644 vdb-entry
- 1022904 vdb-entry
- http://support.apple.com/kb/HT3797
- APPLE-SA-2009-09-14-1 vendor-advisory
- 36673 third-party-advisory