lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.LNX.4.64.0710292225340.5763@localhost>
Date: Mon, 29 Oct 2007 22:49:18 +0100 (CET)
From: Juergen Schmidt <ju@...sec.de>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk,
	vulnwatch@...nwatch.org
Subject: Holes in the firewall of Mac OS X Leopard

Hello,

we did some functional testing on the firewall of Mac OS X Leopard. 
Short summary:

- the firewall is not activated by default but there are services running 
even if you don't activate any sharing (as shown by netstat or lsof)

- if you set it to "Block all incoming connections" it still allows access 
to certain system services. We could access the ntp daemon that is running 
per default over the internet. In a LAN based scenario, we were able to 
query the Netbios naming service even with full blocking enabled.

- if you set it to "Set access to specific services and programs" the 
firewall permits access to listening processes startet by the user, 
regardless if they are in the list of shared services. We were able to 
access a service like "nc -l 1414" over the internet.


ntpd is labeled 4.2.2, the latest version is 4.2.4. It is unknown if any 
of the bugs fixed in the meantime are relevant in this scenario or if 
fixes have been backported. 

The same applies to the Samba package (3.0.25b-apple), of which releases 
3.0.25c and 3.0.26a contained numerous bug fixes.


For more information see:

 A second look at the Mac OS X Leopard firewall
http://www.heise-security.co.uk/articles/98120


bye, ju

-- 
Juergen Schmidt, editor-in-chief heise Security www.heise-security.co.uk
GPG-Key: 0x38EA4970,  5D7B 476D 84D5 94FF E7C5  67BE F895 0A18 38EA 4970

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ