OS X login passwords exposed in cleartext

By

Patch issued.

Apple has issued patches to close OS X flaws that makes user login passwords viewable in clear text to other logged in users.

OS X login passwords exposed in cleartext

The flaws were reported by researcher using the handle Magervalp in April and affected machines running OS X 10.7 - 10.8.4.

Apple has this week released patches for affected versions and recommended all affected users apply it.

The researcher said those managing student labs or public machines should apply the patches immediately.

He said the flaw could be tested by:

Logging into an affected machine with a configuration profile applied as a standard (unprivileged) user either over SSH or with fast user switching enabled, and executing:

$ while true; do ps auxww | grep '[m]dmclient mcx_userlogin'; done

Then logging in with a different user account at the login window and watching the shell's output.

"It's like nails on chalkboard," he wrote in a blog.

Got a news tip for our journalists? Share it with us anonymously here.

Copyright © SC Magazine, Australia

Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Log In

  |  Forgot your password?