CVE-2009-2818

Adaptive Firewall in Apple Mac OS X before 10.6.2 does not properly handle invalid usernames in SSH login attempts, which makes it easier for remote attackers to obtain login access via a brute-force attack (aka dictionary attack).

Affected Software

Name	Vendor	Start Version	End Version
Mac_os_x_server	Apple	*	10.6.1 (including)
Mac_os_x_server	Apple	10.0 (including)	10.0 (including)
Mac_os_x_server	Apple	10.0.0 (including)	10.0.0 (including)
Mac_os_x_server	Apple	10.0.1 (including)	10.0.1 (including)
Mac_os_x_server	Apple	10.0.2 (including)	10.0.2 (including)
Mac_os_x_server	Apple	10.0.3 (including)	10.0.3 (including)
Mac_os_x_server	Apple	10.0.4 (including)	10.0.4 (including)
Mac_os_x_server	Apple	10.1 (including)	10.1 (including)
Mac_os_x_server	Apple	10.1.0 (including)	10.1.0 (including)
Mac_os_x_server	Apple	10.1.1 (including)	10.1.1 (including)
Mac_os_x_server	Apple	10.1.2 (including)	10.1.2 (including)
Mac_os_x_server	Apple	10.1.3 (including)	10.1.3 (including)
Mac_os_x_server	Apple	10.1.4 (including)	10.1.4 (including)
Mac_os_x_server	Apple	10.1.5 (including)	10.1.5 (including)
Mac_os_x_server	Apple	10.2 (including)	10.2 (including)
Mac_os_x_server	Apple	10.2.0 (including)	10.2.0 (including)
Mac_os_x_server	Apple	10.2.1 (including)	10.2.1 (including)
Mac_os_x_server	Apple	10.2.2 (including)	10.2.2 (including)
Mac_os_x_server	Apple	10.2.3 (including)	10.2.3 (including)
Mac_os_x_server	Apple	10.2.4 (including)	10.2.4 (including)
Mac_os_x_server	Apple	10.2.5 (including)	10.2.5 (including)
Mac_os_x_server	Apple	10.2.6 (including)	10.2.6 (including)
Mac_os_x_server	Apple	10.2.7 (including)	10.2.7 (including)
Mac_os_x_server	Apple	10.2.8 (including)	10.2.8 (including)
Mac_os_x_server	Apple	10.3 (including)	10.3 (including)
Mac_os_x_server	Apple	10.3.0 (including)	10.3.0 (including)
Mac_os_x_server	Apple	10.3.1 (including)	10.3.1 (including)
Mac_os_x_server	Apple	10.3.2 (including)	10.3.2 (including)
Mac_os_x_server	Apple	10.3.3 (including)	10.3.3 (including)
Mac_os_x_server	Apple	10.3.4 (including)	10.3.4 (including)
Mac_os_x_server	Apple	10.3.5 (including)	10.3.5 (including)
Mac_os_x_server	Apple	10.3.6 (including)	10.3.6 (including)
Mac_os_x_server	Apple	10.3.7 (including)	10.3.7 (including)
Mac_os_x_server	Apple	10.3.8 (including)	10.3.8 (including)
Mac_os_x_server	Apple	10.3.9 (including)	10.3.9 (including)
Mac_os_x_server	Apple	10.4 (including)	10.4 (including)
Mac_os_x_server	Apple	10.4.0 (including)	10.4.0 (including)
Mac_os_x_server	Apple	10.4.1 (including)	10.4.1 (including)
Mac_os_x_server	Apple	10.4.2 (including)	10.4.2 (including)
Mac_os_x_server	Apple	10.4.3 (including)	10.4.3 (including)
Mac_os_x_server	Apple	10.4.4 (including)	10.4.4 (including)
Mac_os_x_server	Apple	10.4.5 (including)	10.4.5 (including)
Mac_os_x_server	Apple	10.4.6 (including)	10.4.6 (including)
Mac_os_x_server	Apple	10.4.7 (including)	10.4.7 (including)
Mac_os_x_server	Apple	10.4.8 (including)	10.4.8 (including)
Mac_os_x_server	Apple	10.4.9 (including)	10.4.9 (including)
Mac_os_x_server	Apple	10.4.10 (including)	10.4.10 (including)
Mac_os_x_server	Apple	10.4.11 (including)	10.4.11 (including)
Mac_os_x_server	Apple	10.5 (including)	10.5 (including)
Mac_os_x_server	Apple	10.5.0 (including)	10.5.0 (including)
Mac_os_x_server	Apple	10.5.1 (including)	10.5.1 (including)
Mac_os_x_server	Apple	10.5.2 (including)	10.5.2 (including)
Mac_os_x_server	Apple	10.5.3 (including)	10.5.3 (including)
Mac_os_x_server	Apple	10.5.4 (including)	10.5.4 (including)
Mac_os_x_server	Apple	10.5.5 (including)	10.5.5 (including)
Mac_os_x_server	Apple	10.5.6 (including)	10.5.6 (including)
Mac_os_x_server	Apple	10.5.7 (including)	10.5.7 (including)
Mac_os_x_server	Apple	10.5.8 (including)	10.5.8 (including)
Mac_os_x_server	Apple	10.6 (including)	10.6 (including)

NVD	https://nvd.nist.gov/vuln/detail/CVE-2009-2818
CWE	https://cwe.mitre.org/data/definitions/264.html

Affected Software

References