Description
The screensharing feature in the Admin application in Apple Xsan before 2.2 places a cleartext username and password in a URL within an error dialog, which allows physically proximate attackers to obtain credentials by reading this dialog.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53232 ↗
- http://www.securityfocus.com/bid/36385 ↗
- http://osvdb.org/58133 ↗
- http://www.vupen.com/english/advisories/2009/2644 ↗
- http://www.securitytracker.com/id?1022904 ↗
- http://support.apple.com/kb/HT3797 ↗
- http://lists.apple.com/archives/security-announce/2009/Sep/msg00005.html ↗
- http://secunia.com/advisories/36673 ↗