OS X login passwords exposed in cleartext

By

Patch issued.

Apple has issued patches to close OS X flaws that makes user login passwords viewable in clear text to other logged in users.

OS X login passwords exposed in cleartext

The flaws were reported by researcher using the handle Magervalp in April and affected machines running OS X 10.7 - 10.8.4.

Apple has this week released patches for affected versions and recommended all affected users apply it.

The researcher said those managing student labs or public machines should apply the patches immediately.

He said the flaw could be tested by:

Logging into an affected machine with a configuration profile applied as a standard (unprivileged) user either over SSH or with fast user switching enabled, and executing:

$ while true; do ps auxww | grep '[m]dmclient mcx_userlogin'; done

Then logging in with a different user account at the login window and watching the shell's output.

"It's like nails on chalkboard," he wrote in a blog.

Got a news tip for our journalists? Share it with us anonymously here.

Copyright © SC Magazine, Australia

Tags:

Most Read Articles

CBA using facial recognition logins to verify disputed payments

CBA using facial recognition logins to verify disputed payments

Qantas obtains court order to prevent third-party access to stolen data

Qantas obtains court order to prevent third-party access to stolen data

Cloudflare makes changes to avoid repeat of 1.1.1.1 DNS outage

Cloudflare makes changes to avoid repeat of 1.1.1.1 DNS outage

Researchers demo AI-crippling GPUHammer attack

Researchers demo AI-crippling GPUHammer attack

Log In

  |  Forgot your password?