• Open Menu Close Menu
  • Apple
  • Shopping Bag
  • Apple
  • Mac
  • iPad
  • iPhone
  • Watch
  • TV
  • Music
  • Support
  • Search apple.com
  • Shopping Bag
 

Lists

Open Menu Close Menu
  • Terms and Conditions
  • Lists hosted on this site
  • Email the Postmaster
  • Tips for posting to public mailing lists
Re: interesting minor security hole: turning off Remote Apple Events doesn't
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: interesting minor security hole: turning off Remote Apple Events doesn't


  • Subject: Re: interesting minor security hole: turning off Remote Apple Events doesn't
  • From: Sander Tekelenburg <email@hidden>
  • Date: Sat, 3 Sep 2005 15:31:07 +0200

At 07:32 -0700 UTC, on 2005/09/02, Matt Neuburg wrote:

> Turn on Remote Apple Events on a target machine. On a local machine, connect
> with a script like this:
>
> tell application "Finder" of machine "eppc://whatever.local"
>     get name of window 1
> end tell
>
> Now turn off Remote Apple Events on the target machine. Return to the local
> machine, where Script Editor is still sitting there open. Change the script
> and run it again:
>
> tell application "Finder" of machine "eppc://whatever.local"
>     get name of window 2
> end tell
>
> It works!!!!

Confirmed, when the remote machine runs Mac OS X 10.4.2.

When the remote machine runs 10.3.9, immediately after switching Remote
AppleEvents off the script errors:

tell application "Finder" of machine "eppc://whatever.local"
	get name of window 1
	(*-905, Could not establish connection to host*)
		"Finder got an error: Could not establish connection to host"


Btw, trying this from 2 different 10.3.9 machines to a 10.4.2 machine, I
always get the error message in Sript Editor "Syntax Error. Remote access
isn't allowed". Even though when I boot the same local machine into 10.4 it
dcan connect to that same remote machine just fine.

> So even though Remote Apple Events has been turned off at the
> server end, this evidently merely prevents *new* connections from being
> established; existing connections still work.

Looks like it, yes.


--
Sander Tekelenburg, <http://www.euronet.nl/~tekelenb/>
 _______________________________________________
Do not post admin requests to the list. They will be ignored.
Applescript-users mailing list      (email@hidden)
Help/Unsubscribe/Update your Subscription:

This email sent to email@hidden

References: 
 >interesting minor security hole: turning off Remote Apple Events doesn't (From: Matt Neuburg <email@hidden>)

  • Prev by Date: Re: what is Image Capture Scripting?
  • Next by Date: Re: Determining if a scripting addition is installed
  • Previous by thread: interesting minor security hole: turning off Remote Apple Events doesn't
  • Next by thread: Re: turn on Remote Apple Events remotely?
  • Index(es):
    • Date
    • Thread