Mailing Lists: Apple Mailing Lists
Image of Mac OS face in stamp
 
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Macsec] world readable password hashes

okay, test:
#include <sys/types.h>
#include <pwd.h>
#include <iostream>

int main(void) {
struct passwd *p;
p = getpwnam("root");
cout << p->pw_name << ":" << p->pw_passwd << endl;
return 0;
}

you will get the root user's name and password hash..
i tested this on linux with shadowing implemented and got a '*' instead of the passwd hash (as expected)

so it appears that shadowing is not properly implemented if any user can request and access the hashes, but the files containing them are only directly accessable by root...

hmph
anyway.. uni exams next week
when they're over i'll have a good look at the source and see what i can find

This is actually a old problem that not everyone decided to fix. It uses
repeated calls to getpwent() (from pwd.h) to obtain all the information.
Since it is old it was not reported to any bugtraq like mailing lists other
than MOSX specific lists. I did inform apple about it once they opened up
their security site but its been about a month and they havent replied. Im
really disapointed that they took no intrest at all in a security flaw like
this. I did test this on a AIX (4.2 I think) box and it worked. If you want
more information on getpwent go pull up its man page.

On 6/15/01 10:58 AM, "Loukas" <email@hidden> wrote:

I've looked at your "OSXploit", and i'd be very interested to see your
source code. I hope you have reported this "bug in the BSD shadowing
subsystem" to the appropriate people (ie. vuln-dev, bugtraq, whoever
wrote the password shadowing suite for SVR4, *BSD security mailing lists...).

However, if this is MacOSX/Darwin specific, then i doubt that it is a
problem in the actual BSD implementation of shadowed passwords.
>
> Because i could not view your source code, i have written my own "OSXploit":


--

References: 
 >Re: [Macsec] world readable password hashes (From: Marukka <email@hidden>)



Visit the Apple Store online or at retail locations.
1-800-MY-APPLE

Contact Apple | Terms of Use | Privacy Policy

Copyright © 2007 Apple Inc. All rights reserved.