CVE-2008-3611

Login Window in Apple Mac OS X 10.4.11 does not clear the current password when a user makes a password-change attempt that is denied by policy, which allows opportunistic, physically proximate attackers to bypass authentication and change this user's password by later entering an acceptable new password on the same login screen.

• CWE-287

• http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html
• http://secunia.com/advisories/31882Vendor Advisory
• http://securitytracker.com/id?1020878
• http://www.securityfocus.com/bid/31189Patch
• http://www.us-cert.gov/cas/techalerts/TA08-260A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2008/2584Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45171
• http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html
• http://secunia.com/advisories/31882Vendor Advisory
• http://securitytracker.com/id?1020878
• http://www.securityfocus.com/bid/31189Patch
• http://www.us-cert.gov/cas/techalerts/TA08-260A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2008/2584Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45171

Published

Sep 16, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-3605Unspecified vulnerability in McAfee Encrypted USB Manager 3.…
• CVE-2008-3606Heap-based buffer overflow in the IMAP service in Qbik WinGa…
• CVE-2008-3607The IMAP server in NoticeWare Email Server NG 4.6.3 and earl…
• CVE-2008-3608ImageIO in Apple Mac OS X 10.4.11 and 10.5 through 10.5.4 al…
• CVE-2008-3609The kernel in Apple Mac OS X 10.5 through 10.5.4 does not pr…
• CVE-2008-3610Race condition in Login Window in Apple Mac OS X 10.5 throug…
• CVE-2008-3612The Networking subsystem in Apple iPod touch 2.0 through 2.0…9.8
• CVE-2008-3613Finder in Apple Mac OS X 10.5.2 through 10.5.4 allows remote…
• CVE-2008-3614Integer overflow in Apple QuickTime before 7.5.5 on Windows …
• CVE-2008-3615ir50_32.qtx in an unspecified third-party Indeo v5 codec for…
• CVE-2008-3616Multiple integer overflows in the SearchKit API in Apple Mac…
• CVE-2008-3617Remote Management and Screen Sharing in Apple Mac OS X 10.5 …