Mailing Lists: Apple Mailing Lists
Image of Mac OS face in stamp
 
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Macsec] world readable password hashes

This is actually a old problem that not everyone decided to fix. It uses
repeated calls to getpwent() (from pwd.h) to obtain all the information.
Since it is old it was not reported to any bugtraq like mailing lists other
than MOSX specific lists. I did inform apple about it once they opened up
their security site but its been about a month and they havent replied. Im
really disapointed that they took no intrest at all in a security flaw like
this. I did test this on a AIX (4.2 I think) box and it worked. If you want
more information on getpwent go pull up its man page.

On 6/15/01 10:58 AM, "Loukas" <email@hidden> wrote:

> I've looked at your "OSXploit", and i'd be very interested to see your
> source code. I hope you have reported this "bug in the BSD shadowing
> subsystem" to the appropriate people (ie. vuln-dev, bugtraq, whoever
> wrote the password shadowing suite for SVR4, *BSD security mailing lists...).
>
> However, if this is MacOSX/Darwin specific, then i doubt that it is a
> problem in the actual BSD implementation of shadowed passwords.
>
> Because i could not view your source code, i have written my own "OSXploit":



Visit the Apple Store online or at retail locations.
1-800-MY-APPLE

Contact Apple | Terms of Use | Privacy Policy

Copyright © 2007 Apple Inc. All rights reserved.