CVE-1999-1076 Auth bypass in n/a
Local attackers can bypass MacOS 9 idle session password protection by canceling a logout dialog, regaining access to the locked session.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-1999-1076?
CVE-1999-1076 is a medium-severity authentication bypass vulnerability in Apple Macos, published on 12 Sep 2001. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Idle locking function in MacOS 9 allows local users to bypass the password protection of idled sessions by selecting the "Log Out" option and selecting a "Cancel" option in the dialog box for an application that attempts to verify that the user wants to log out, which returns the attacker into the locked session.
Which versions are affected by CVE-1999-1076?
It affects 1 product.
Products include Apple Macos.
How do I fix CVE-1999-1076?
No fix has been published for CVE-1999-1076 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-1999-1076 being exploited?
There is no known exploitation of CVE-1999-1076 in the wild and no public exploit code.
Other vulnerabilities in Apple Macos
Sources
Also known as GHSA-54c2-phxc-2hgx.