|
Brought to you by:
Suppliers of:
|
|
|
| |
| Nidump is a Mac OS X data extraction program. A vulnerability in this program yields read access to the Mac OS X password file. The password file itself is still encrypted but reading the password file is the first step into decrypting it and retrieving a username and password list. |
| |
Credit:
The information has been provided by Macintosh Security and Gregory Hedo.
|
| |
A security vulnerability has been identified in MacOS. The vulnerability allows the usage of nidump to get a viewable copy of the password that can then be processed through a password cracker to obtain the unencrypted version of the passwords.
Exploit:
As a local user (not admin, not root), type in the terminal:
nidump passwd /
And you will get the full content of the password file (Tested on Mac OS X 10.2.3).
|
|
|
|
|
