CVE-2017-7149 | BDVDB-2026-92167 Detail
Description#
An issue was discovered in certain Apple products. macOS before 10.13 Supplemental Update is affected. The issue involves the "StorageKit" component. It allows attackers to discover passwords for APFS encrypted volumes by reading Disk Utility hints, because the stored hint value was accidentally set to the password itself, not the entered hint value.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- https://hackernoon.com/new-macos-high-sierra-vulnerability-exposes-the-password-of-an-encrypted-apfs-container-b4f2f5326e79
- https://support.apple.com/HT208165
- http://www.securitytracker.com/id/1039513
- https://www.theregister.co.uk/2017/10/05/apple_patches_password_hint_bug_that_revealed_password/
- http://www.securityfocus.com/bid/101178
- https://nakedsecurity.sophos.com/2017/10/05/urgent-update-your-mac-again-right-now/
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.