OS X login passwords exposed in cleartext

Apple has issued patches to close OS X flaws that makes user login passwords viewable in clear text to other logged in users.

The flaws were reported by researcher using the handle Magervalp in April and affected machines running OS X 10.7 - 10.8.4.

Apple has this week released patches for affected versions and recommended all affected users apply it.

The researcher said those managing student labs or public machines should apply the patches immediately.

He said the flaw could be tested by:

Logging into an affected machine with a configuration profile applied as a standard (unprivileged) user either over SSH or with fast user switching enabled, and executing:

$ while true; do ps auxww | grep '[m]dmclient mcx_userlogin'; done

Then logging in with a different user account at the login window and watching the shell's output.

"It's like nails on chalkboard," he wrote in a blog.

Copyright © SC Magazine, Australia