Nidump is a Mac OS X data extraction program. A vulnerability in this program yields read access to the Mac OS X password file. The password file itself is still encrypted but reading the password file is the first step into decrypting it and retrieving a username and password list.
A security vulnerability has been identified in MacOS. The vulnerability allows the usage of nidump to get a viewable copy of the password that can then be processed through a password cracker to obtain the unencrypted version of the passwords.
Exploit:
As a local user (not admin, not root), type in the terminal: nidump passwd /
And you will get the full content of the password file (Tested on Mac OS X 10.2.3).
