WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 sends NTLM credentials in cleartext in unspecified circumstances which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors.