CVE-2001-1412

macOS X < 10.3 - Unauthenticated Password File Read via nidump passwd Argument

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2001-1412. PoCs published by Steven Kreuzer.

AI-analyzed exploit summary This is a writeup describing a vulnerability in MacOS X where the `nidump` utility can be used to extract sensitive information, including passwords, from the NetInfo database. The issue arises due to improper file permissions and can be exploited remotely if certain conditions are met.

Description

nidump on MacOS X before 10.3 allows local users to read the encrypted passwords from the password file by specifying passwd as a command line argument.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Steven Kreuzer · textremoteosx

https://www.exploit-db.com/exploits/20984

View Code ZIP pw:eip

This is a writeup describing a vulnerability in MacOS X where the `nidump` utility can be used to extract sensitive information, including passwords, from the NetInfo database. The issue arises due to improper file permissions and can be exploited remotely if certain conditions are met.

Classification

Writeup 90%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: Apple MacOS X (all versions)

No auth needed

Prerequisites: portmap and netinfobind must be listening on the target host · remote tags must be used for nidump

MITRE ATT&CK