CVE-2016-4745

The Kerberos 5 (aka krb5) PAM module in Apple OS X before 10.12 does not use constant-time operations for determining username validity, which makes it easier…

published September 25, 2016

CVSS
—
EPSS
2%
Percentile
77.7
In the wild
Unconfirmed
What it is

The Kerberos 5 (aka krb5) PAM module in Apple OS X before 10.12 does not use constant-time operations for determining username validity, which makes it easier for remote attackers to enumerate user accounts via a timing side-channel attack.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01759 · 77.7th percentile
Published
2016-09-25T10:00Z
EPSS history
Timeline
  • 25 SEP 10:00Z
    The Kerberos 5 (aka krb5) PAM module in Apple OS X before 10.12 does not use constant-time operations for determining username validity, which makes it easier…
    cvelistv5