Re: Re: Apple Remote Desktop root vulneravility

[securityfocus () firefiter com]

This is not so much a vulnerability as an oversight.  Who's oversight is up to you, but if you run a process remotely 
as root, and it has a GUI, then the GUI will appear on the screen, as a root process.  This usually involves a menubar, 
adn thereby access to System Preferences.  An easy demonstration is using SSH to log into a box, sudo -s to get a root 
shell, and execute ANY program in the applications directory (open -a Safari).  You'll get Safari and access to the 
menubar with the login window appearing as a hinderance.  This isn't anything new, the guy's using RADMIND have been 
fighting it since 10.4 came out and redid the way the system handles the login window at startup.  On the automated 
side, applicatiosn like iHook have created a very nice work around for this.  At the ARD end, the lock screen function 
does this well enough.  Its merely a matter of testing deployment on a machine you have physical access to before 
shoving it down to x-number of computers.  

This is something John Welch (bynkii.com) harped about this spring.  Its shoddy design on many App Designers by not 
giving a proper remote installer or pkg file that can execute silently.  Whether or not this is something Apple needs 
to fix, that's up for debate.  They are not necessairly in the wrong here, regardless of how much it may appear to be 
an obvious security flaw.  Maybe they should check to see if the LoginWindow is displayed before allowing a gui app to 
run with root priviledges, but after debating this issue enough i've come to the conclusion that Apple, the 
programmers, and the administrators, are all at fault at some level.