CVE-2010-1838 Auth bypass in n/a
Remote attackers can bypass authentication in macOS Directory Services by providing a valid account name when mobile accounts are disabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2010-1838?
CVE-2010-1838 is a medium-severity authentication bypass vulnerability in Apple Mac Os X, published on 15 Nov 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Directory Services in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 does not properly handle errors associated with disabled mobile accounts, which allows remote attackers to bypass authentication by providing a valid account name.
Weakness: CWE-287
Which versions are affected by CVE-2010-1838?
It affects 2 products.
Products include Apple Mac Os X, Apple Mac Os X Server.
How do I fix CVE-2010-1838?
No fix has been published for CVE-2010-1838 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2010-1838 being exploited?
There is no known exploitation of CVE-2010-1838 in the wild and no public exploit code.
Other vulnerabilities in Apple Mac Os X
Sources
Also known as GHSA-8c65-gxhm-w49w.