bugtraq - Re: Re: Apple Remote Desktop root vulneravility

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060926182432.7077.qmail@securityfocus.com>
Date: 26 Sep 2006 18:24:32 -0000
From: securityfocus@...efiter.com
To: bugtraq@...urityfocus.com
Subject: Re: Re: Apple Remote Desktop root vulneravility

This is not so much a vulnerability as an oversight.  Who's oversight is up to you, but if you run a process remotely as root, and it has a GUI, then the GUI will appear on the screen, as a root process.  This usually involves a menubar, adn thereby access to System Preferences.  An easy demonstration is using SSH to log into a box, sudo -s to get a root shell, and execute ANY program in the applications directory (open -a Safari).  You'll get Safari and access to the menubar with the login window appearing as a hinderance.  This isn't anything new, the guy's using RADMIND have been fighting it since 10.4 came out and redid the way the system handles the login window at startup.  On the automated side, applicatiosn like iHook have created a very nice work around for this.  At the ARD end, the lock screen function does this well enough.  Its merely a matter of testing deployment on a machine you have physical access to before shoving it down to x-number of computers.  

This is something John Welch (bynkii.com) harped about this spring.  Its shoddy design on many App Designers by not giving a proper remote installer or pkg file that can execute silently.  Whether or not this is something Apple needs to fix, that's up for debate.  They are not necessairly in the wrong here, regardless of how much it may appear to be an obvious security flaw.  Maybe they should check to see if the LoginWindow is displayed before allowing a gui app to run with root priviledges, but after debating this issue enough i've come to the conclusion that Apple, the programmers, and the administrators, are all at fault at some level.