Race condition in Apple MAC OS X

1) Race condition

EUVDB-ID: #VU44100

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2012-0656

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Race condition in LoginUIFramework in Apple Mac OS X 10.7.x before 10.7.4, when the Guest account is enabled, allows physically proximate attackers to login to arbitrary accounts by entering the account name and no password.

Mitigation

Install update from vendor's website.

Vulnerable software versions

macOS: 10.7.0 - 10.7.3

CPE2.3

• cpe:2.3:o:apple:macos:10.7.0:*:*:*:*:*:*:*
• cpe:2.3:o:apple:macos:10.7.1:*:*:*:*:*:*:*
• cpe:2.3:o:apple:macos:10.7.2:*:*:*:*:*:*:*
• cpe:2.3:o:apple:macos:10.7.3:*:*:*:*:*:*:*

External links

https://lists.apple.com/archives/security-announce/2012/May/msg00001.html
https://support.apple.com/kb/HT5281
https://www.securityfocus.com/bid/53445
https://www.securityfocus.com/bid/53459

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.