Re: NETRAGARD-20060624 SECURITY ADVISORY] [ROXIO TOAST 7 TITANIUM - LOCAL ROOT COMPROMISE ]

[Propaganda Support <support () propagandaprod com>]

On Aug 22, 2006, at 3:22 PM, K F wrote:

> the admin users on OS X can NOT become root at any time.

Yes, they can.

> The admin user must first know the admin password before becomming  
> root.

Obviously. An admin user who doesn't know the admin password is not  
an admin user. He/she is a different user using an admin user's account.

> Based on the info below ANYONE that sits down at your pc while it  
> is logged in can take advantage of the fact that you can take root  
> WITHOUT a password using the technique outlined below.

Not true. They must provide an admin password to use the Deja Vu pref  
pane, unless the admin user chose to leave it unlocked. (It's locked  
by default.)

> Don't act like you have never let someone use a web browser or log  
> into instant messenger on your computer before...

I don't have to act like it, because I don't unless I trust the  
person completely. I have a guest account for anyone else.

If you let people that you don't trust use your logged in admin  
account, you're asking for all kinds of trouble, whether or not you  
have Deja Vu installed. They could delete any/all folders within your  
Home folder, for example.

Kind Regards,
-jeff

--
Jeff Holland
http://propagandaprod.com


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/