Security Basics mailing list archives
Re: Netinfo Manager
From: Ansgar -59cobalt- Wiechers <bugtraq () planetcobalt net>
Date: Wed, 24 Sep 2003 00:18:41 +0200
On 2003-09-23 Gene Cronk wrote:
Matteo wrote:I'm using Mac OS 10.2.8 Server and today I was quite surprised to see that a normal user on my server can obtain the encrypted passwords of all the user just using the command "nidump password .": bash-2.05a$ nidump passwd . nobody:*:-2:-2::0:0:Unprivileged User:/dev/null:/dev/null root:*EncryptedPass:0:0::0:0:System Administrator:/var/root:/bin/tcsh ... Isn't this a security flaw? Is Apple going to fix it in the next release of Mac OS X (Panther)? Now, how to prevent users to see the passwords of the other users?Wouldn't chown root nidump and chmod 700 nidump fix this?
I don't have an OS X at hand, but I think one could easily get another copy of nidump onto the system and use this copy to dump the NetInfo database. Regards Ansgar Wiechers --------------------------------------------------------------------------- ----------------------------------------------------------------------------
Current thread:
- Netinfo Manager Matteo (Sep 23)
- Re: Netinfo Manager Jos Kirps|EducDesign (Sep 23)
- Re: Netinfo Manager Dave Botsch (Sep 24)
- Re: Netinfo Manager Jos Kirps|EducDesign (Sep 24)
- Re: Netinfo Manager Dave Botsch (Sep 24)
- Re: Netinfo Manager Gene Cronk (Sep 23)
- Re: Netinfo Manager Ansgar -59cobalt- Wiechers (Sep 23)
- <Possible follow-ups>
- Re: Netinfo Manager Matt Burnett (Sep 25)
- Re: Netinfo Manager Jos Kirps|EducDesign (Sep 23)