CVE-2009-2818

Apple Mac OS X Server < 10.6.1 - Adaptive Firewall SSH Brute-Force Protection Bypass

Title source: llm

Description

Adaptive Firewall in Apple Mac OS X before 10.6.2 does not properly handle invalid usernames in SSH login attempts, which makes it easier for remote attackers to obtain login access via a brute-force attack (aka dictionary attack).

References (4)

Core 4

Core References

Patch vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/36956

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2009/3184

Vendor Advisory vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html

Patch, Vendor Advisory x_refsource_confirm

http://support.apple.com/kb/HT3937

Scores

EPSS 0.0188

EPSS Percentile 77.3%

Details

CWE

CWE-264

Status published

Products (50)

apple/mac_os_x_server 10.0

apple/mac_os_x_server 10.0.0

apple/mac_os_x_server 10.0.1

apple/mac_os_x_server 10.0.2

apple/mac_os_x_server 10.0.3

apple/mac_os_x_server 10.0.4

apple/mac_os_x_server 10.1

apple/mac_os_x_server 10.1.0

apple/mac_os_x_server 10.1.1

apple/mac_os_x_server 10.1.2

... and 40 more

Published Nov 10, 2009

Tracked Since Feb 18, 2026