bugtraq - Re: MacOSX - crash screensaver locked with password and get the desktop back

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 07 Jul 2003 11:10:05 -0400
From: "Adam H. Pendleton" <fmonkey@...nkey.net>
To: bugtraq@...urityfocus.com
Subject: Re: MacOSX - crash screensaver locked with password and get the	desktop
 back


Delfim Machado wrote:

>three days ago i discovered a security issue, with the last MacOSX. 
>
>there is a way to crash the screensaver locked with password and gain
>the desktop.
>
This isn't a new issue; well not exactly.  The method for crashing to 
screensaver is new to me, but the result isn't.  When I first got my 
Powerbook (December of last year), it came with a .Mac screensaver 
which, IIRC, attempts to load its slideshow images off the Internet.  At 
the time, I was able to crash the .Mac screensaver by pulling the 
network plug while the screensaver was trying to update its images.  
Doing this caused the screensaver to crash and the Desktop to return 
(despite password locking).  I reported this vulnerability to Apple, but 
never got a response, and it obviously hasn't been fixed.  I don't have 
an exact date on when I originally reported it, but I believe it was 
sometime in January '03.

ahp