Login Window in Apple Mac OS X 10.7.3, when Legacy File Vault or networked home directories are enabled, does not properly restrict what is written to the system log for network logins, which allows local users to obtain sensitive information by reading the log.

The remote host is running a version of Mac OS X 10.7 that is older than version 10.7.5.  The newer version contains numerous security-related fixes for the following components :

  - Apache

  - BIND

  - CoreText

  - Data Security

  - ImageIO

  - Installer

  - International Components for Unicode

  - Kernel

  - Mail

  - PHP

  - Profile Manager

  - QuickLook

  - QuickTime

  - Ruby

  - USB

The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.5. The newer version contains multiple security-related fixes for the following components :

  - Apache
  - BIND
  - CoreText
  - Data Security
  - ImageIO
  - Installer
  - International Components for Unicode
  - Kernel
  - Mail
  - PHP
  - Profile Manager
  - QuickLook
  - QuickTime
  - Ruby
  - USB

The remote host is running a version of Mac OS X 10.7 that is older than version 10.7.4.  The newer version contains numerous security-related fixes for the following components :

  - Login Windows
  - Bluetooth
  - curl
  - HFS
  - Kernel
  - libarchive
  - libsecurity
  - libxml
  - LoginUIFramework
  - PHP
  - Quartz Composer
  - QuickTime
  - Ruby
  - Security Framework
  - Time Machine
  - X11

Plaintext passwords were discovered in a system log file.  Mac OS X Lion release 10.7.3 enabled a debug logging feature that causes plaintext passwords to be logged to /var/log/secure.log on systems that use certain FileVault configurations.  A local attacker in the admin group or an attacker with physical access to the host could exploit this to get user passwords, which could be used to gain access to encrypted partitions.

The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.4. The newer version contains numerous security-related fixes for the following components :

  - Login Window
  - Bluetooth
  - curl
  - HFS
  - Kernel
  - libarchive
  - libsecurity
  - libxml
  - LoginUIFramework
  - PHP
  - Quartz Composer
  - QuickTime
  - Ruby
  - Security Framework
  - Time Machine
  - X11

Note that this update addresses the recent FileVault password vulnerability, in which user passwords are stored in plaintext to a system-wide debug log if the legacy version of FileVault is used to encrypt user directories after a system upgrade to Lion. Since the patch only limits further exposure, though, we recommend that all users on the system change their passwords if user folders were encrypted using the legacy version of FileVault prior to and after an upgrade to OS X 10.7.

ID	Name	Product	Family	Severity
6583	Mac OS X 10.7 < 10.7.5 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
62214	Mac OS X 10.7.x < 10.7.5 Multiple Vulnerabilities (BEAST)	Nessus	MacOS X Local Security Checks	critical
6482	Mac OS X 10.7 < 10.7.4 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
59090	Mac OS X FileVault Plaintext Password Logging	Nessus	MacOS X Local Security Checks	low
59066	Mac OS X 10.7.x < 10.7.4 Multiple Vulnerabilities (BEAST)	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2012-0652

medium

Tenable Plugins

critical

critical

critical

low

critical