Lion security flaw makes cracking, changing passwords easier !!!!!

TattooedMac · Sep 20, 2011

Lion security flaw makes cracking, changing passwords easier !!!!

Lion security flaw makes cracking, changing passwords easier

According to researcher Patrick Dunstan, Directory Services' command line utility can be run by any user. By itself, this isn't necessarily a security problem, but at least two functions make it trivial to access user password hashes or even change the current user's password without administrator authentication.

McYukon · Sep 20, 2011

Not to worry, I bet the next security update will fix it.

harryb2448 · Sep 20, 2011

There was a Security Update last week, and as Apple do not release update details, who knows?

osxx · Sep 21, 2011

That and 10.7.2 is just around the corner.

TattooedMac · Sep 21, 2011

Yes yes i know I just thought (i did anyways) it would be a interesting read as to where and how the hole was/is . . . .
Is the 10.7.2 GM available to developers as yet or still in the Beta ??

dtravis7 · Sep 21, 2011

It was interesting. Thanks for posting. Not sure on 10.7.2.

Nethfel · Sep 21, 2011

I read the article, it is something to be concerned about. One has to wonder if this flaw also exists in earlier versions of OSX?

I am also a little concerned about the fact that no where did they mention that Apple was notified of this... They say until Apple can secure it - but usually when a security flaw has been found, the article that describes the flaw almost always made clear that Apple has been made aware of the issue - this was not the case in this article, which makes me wonder - was Apple notified? If not, why (perhaps to get some publicized recognition for the "researcher"?

baggss · Sep 21, 2011

This assumes 2 things:

1) "If a remote user can gain shell access". Meaning your computer has been left unsecured despite all other security protections built in. It also means you have managed to do something to make yourself a target. Fair enough, but a fairly big "IF" IMO.

2) The person has physical access to your computer, in which case you managed to lose it somehow. This is probably the bigger of the two threats, frankly anyone who knows anything abut OSX can steal your computer and change the password, it's not rocket science.

In the end, while it is a flaw and does need to be fixed, I won't be getting my panties all bunched up over it.

TattooedMac · Sep 21, 2011

Nethfel said:
I am also a little concerned about the fact that no where did they mention that Apple was notified of this... They say until Apple can secure it - but usually when a security flaw has been found, the article that describes the flaw almost always made clear that Apple has been made aware of the issue - this was not the case in this article, which makes me wonder - was Apple notified? If not, why (perhaps to get some publicized recognition for the "researcher"?

Thats a good point and one that i over looked. Will be interesting to see if they push through the X.7.2 GM or will they knock up a patch specifically for the security issue. As usual we can only wait until  decide to pull there finger out.

Cheers