10 ms·
Mac OS X Lion accepts any password when authenticating via LDAP
- fredoliveira 15y agoThis looks both real and a pretty serious issue (I wonder how it went by almost a month without getting picked up by the security community). There's an discussion about it on Apple's own forums, linked below, but the gist of it is that users can authenticate over LDAP using any password using the login screen, and can't authenticate at all using su: https://discussions.apple.com/message/15887083 https://discussions.apple.com/message/15887083
- tptacek 15y agoNot many people in the security community use Mac servers in such a way that they need LDAP, and of those people, very few are running Lion on their servers.
- perlgeek 15y agoWouldn't Mac clients need LDAP for authentification too?
- sorbus 15y agoAre you saying that the fact that this issue doesn't effect many people means that it's not a serious security problem?
- bonzoesc 15y agoHe's saying that since the issue doesn't affect many people it didn't get found right away. It is a serious security problem for businesses that use Mac OS X with LDAP. However, it's not a serious security problem for me.
- sorbus 15y agoIt's been known for just under a month, since five days after OS X Lion was released, so that interpretation of his statement seems incorrect.
- bonzoesc 15y ago> This looks both real and a pretty serious issue (I wonder how it went by almost a month without getting picked up by the security community). Followed by: > Not many people in the security community use Mac servers in such a way that they need LDAP, and of those people, very few are running Lion on their servers. Therefore, we see that Mr. Ptacek thinks "it went by almost a month without getting picked up by the security community" because "Not many people in the security community use Mac servers".
- tptacek 15y agoIn the interest of expedience, let me be blunt: very few security researchers give a shit about how OS X Server uses LDAP. We're all pretty busy lately, too. (-2. You guys are funny. In case it matters: I'm not being snarky. They really don't).
- MostAwesomeDude 15y agoIt wasn't your bug to find, it was Apple's, and they should have found it far sooner.
- tptacek 15y agoWho are you talking to? Me? Did you read the comment thread? I'm not sure who you're arguing with, or why you picked me for this reply.
- MostAwesomeDude 15y agoYeah, you're right, I misposted. Sorry.
- Sidnicious 15y agoI wasn't entirely clear from the link — Are Lion servers not being picky about passwords, or are Lion clients not being picky about LDAP authentication failing (hence not being able to mount the user's home folder)? If the latter, the impact is bad, but not as bad (you'll be able to get access to the machine you're sitting at, but not to any server-side resources).
- ataraxia 15y agoAgreed that few are relying on Lion servers. But the security flaw is at the side of the Mac client, not the server. If you have Lion clients authenticating against OpenLDAD hosted on, say, a Linux server, then only the username is checked and any password is accepted. IMHO this is a serious security flaw that should be fixed as soon as possible by Apple.
- deleted 15y ago[deleted]
- Hovertruck 15y agoWhat alarms me is that on both of my computers with Lion, about half of the time just clicking on a name on the login screen works without entering the password. Happens on my friend's Lion install as well.
- wgx 15y agoI have authentication on after every screensaver and I've never been able to bypass the password. Weird.
- tptacek 15y agoLikewise. We're an all-Mac shop, we do semiregular audits of everyone's machines, and I've never seen this happen.
- cylo 15y agoI have never had that happen to me on all 3 of my Lion machines. Could you elaborate some more about your circumstances with this glitch?
- deleted 15y ago[deleted]
- Bud 15y agoI'm going to guess that this is very simple; he probably just has the option for requiring a password at login turned off, or is using Fast User Switching enabled (i.e., the user is question was not really logged out, so logging in and entering a password is not required), or something like this.
- epo 15y agoThere is an option "Require password <time period> after sleep or screen saver begins" in the Security preferences, general tab. I'll bet yours is set to something other than "immediately".
- Hovertruck 15y ago
- brudgers 15y ago<snark>Well, it is intended to be a lightweight protocol after all.</snark>
- abcd_f 15y agoNot sure why you are in gray. That's a really good joke.
- deleted 15y ago[deleted]
- smithian 15y agoCan anyone confirm or deny that this is only an issue when authenticating to an OpenLDAP server (i.e. does it also affect authentication against Active Directory?) I will check it when I get to the office and update here. This could potentially be very serious.
- awakeasleep 15y agoActive directory works as you'd expect.
- authorityaction 15y agoWe just got some Lion iMacs and have not been able to keep them connected to the AD. It doesn't work as expect unfortunately.
- amazingman 15y agoAre you talking about the "Network accounts unavailable" red light? If you wait ~20secs, it generally resolves itself. Definitely a bug, but just an annoying one.
- authorityaction 15y agoYep, that's the one. We've tried waiting and even increased the timeout from 2 seconds to something higher and it's still not working.
- wuster 15y agoOh yikes. This deserves an update... yesterday. How can it be discovered and discussed only a month later?
- edtechdev 15y agoThere have long been issues with LDAP in Mac OS X. They don't use a standard version. It doesn't work with PHP's LDAP module. And there have long been security issues, too: PHP was often out of date with security vulnerabilities. So much so that our campus ended up blocking all Mac web servers. Here are several other issues I wrote up a couple of years ago, the last time I was forced to use Mac OS X server: http://edtechdev.wordpress.com/2009/01/31/dont-use-mac-os-x-as-a-server/ http://edtechdev.wordpress.com/2009/01/31/dont-use-mac-os-x-...
- delinka 15y agoIf you're hosting PHP on a Mac, I'd hope you're using a package manager so that you're not depedent on Apple to update third party software. Perhaps they should be providing timely updates to third party items that they include, but depending on those updates is foolhardy.
- smcj 15y agoLet's wait until Jon Gruber educates us that this is the right thing to do.
- city41 15y agoCan someone give a quick lowdown on what's really happening here? I am assuming the Lion client is connecting to an LDAP server using the provided password, and regardless of the response from LDAP, Lion proceeds with the login?
- a2tech 15y agoNo-if you try to submit a blank password it is (rightly) rejected. If you submit a non-blank password, the login succeeds. This (to me) points to the LDAP server responding with a login success message and the OS allowing the user in. This bug appears to only effect Lion clients talking to OpenLDAP (not the LDAP server shipped with Lion Server) or Active Directory.
- ataraxia 15y agoI played with a Lion client bound to OpenLDAP running on a Linux server. I could login with my username and any password (empty or not). I used a packet sniffer and it appeared to me, that the Lion client is not even sending the password to the server, but simply logging the user in. At least in my case, the server didn't send any login success message, and the Lion still let the user in. It clearly seems to be an issue on the side of the Mac OS X client, not the server.
- elb0w 15y agoSays this is a solution: https://discussions.apple.com/message/15700245 https://discussions.apple.com/message/15700245
- SoftwareMaven 15y agoFirst, this is a terrible bug. Shame on Apple for not rushing a fix, but... Enterprises should not be doing immediate upgrades to any operating system, no matter how sparkly. I'm still waiting to upgrade my MacBook, and it's just me. No OS release goes off without a hitch (though there are some pretty impressive Linux releases!).
- tomelders 15y agoIn all fairness, someone has to be an early adopter, otherwise issues like this would go unnoticed. I've no idea how complex a problem it is to fix, but it is worrying that it seems to be taking a while for Apple to fix it.
- weaksauce 15y agoI think you are missing the point that the gp is making; any enterprise that this would affect should not be provisioning it to the servers/clients until they test it on a smaller scale. This issue would be found during the normal testing channels of enterprise adoption.
- shaggyfrog 15y agoI had to upgrade to continue using the latest Xcode, although I'm not running that on Server.
- joxenford 15y agoNothing worse that righteous preaching...who knows what the op reasons are for upgrading...there could be very compelling reasons to move very quickly especially with Apple. Some models of newer Mac won't run anything older than the current OS release
- napierzaza 15y agoWhy are they not using Kerberos and SSL though? Does this affect those users who actually do take security seriously or just the bare bones implementations that aren't safe anyways?
- tptacek 15y agoThis got downvoted but is a perfectly valid question, since LDAP->OSX authentication is used virtually exclusively on internal networks where the assumption needs to be that attackers can see network traffic anyways.
- marshray 15y agoI don't know about Macs specifically (Apple makes servers?) or why they aren't using Kerb, but LDAP is commonly used over SSL/TLS. "LDAPS" some call it. LDAP wasn't originally designed to be an authentication protocol. If Mac clients are using it to make authentication decisions, they had better be requiring SSL/TLS on that connection (and validating the server cert perfectly, too).
- marshray 15y agoApparently, the forum poster says he's not using SSL/TLS with LDAP for the login authentication. Sounds to me like impersonating an LDAP server would grant login to Macs configured thusly.
- paxswill 15y agoNot entirely relevant, but Lion's Kerberos is pretty funky as well. Apple switched to Heimdal from MIT, supposedly marked the Heimdal API 'private' and provided a worse than broken shim between the MIT API and Heimdal.
- a2tech 15y agoThis is only an issue when binding to an OpenLDAP server. There may be additional issues with LDAP on Lion server, but this problem as reported is an issue with Lion clients bound to servers running OpenLDAP without Kerberos or SSL.
- matsur 15y agoYour use of the word "only" here is misplaced. This is a very serious security issue that affects clients connecting to OpenLDAP.
- a2tech 15y agoIndeed-for users that are bound to OpenLDAP its a massive issue. Without knowing those users exact setup its hard to know exactly what the issue is-the fact that its ONLY OpenLDAP servers is odd. The client must be receiving some sort of authentication succeeded message (you will note that it won't accept a blank password-so in that case OpenLDAP is responding with a failure). It may be a bug in Lion that triggers a bug in OpenLDAP.
- marshray 15y agoIt may also be possible for an attacker to impersonate an OpenLDAP server in order to induce (and exploit) the behavior.
- niels_olson 15y agowhich is possibly quite a few university macs in libraries and computer labs.
- wtallis 15y agoReally? Can you name even one university that uses LDAP but not Kerberos for their computer labs?
- niels_olson 15y agoWell, I could name one that almost certainly doesn't, but I'll refrain.
- blinkingled 15y agoTells you something about Apple's testing methodology. QA team at Apple must be playing real fast and loose. Being affected by 3 serious regressions in Lion (all filed as bugs and Apple closed them as duplicates, btw) - I get the feeling that Apple could do better at software engineering. (Alarms on iOS if you are still not convinced :) Just the fact that they release software that allows authentication without correct password means that they lack any kind of automated test case verification even for basic functionality - and this is basic functionality we are talking about, not some obscure thing that happens only when dozen different factors are combined or a thing that only happens once in billion tries. Say what you will about Microsoft but in my several years of using Windows I rarely had these type of glaring issues even with the awful amount of hardware it supports. It might just be that Microsoft was forced to adopt better Engineering practices due to their situation - lot of complexity, huge impact potential, and lot of money at stake - 50% server market and the Server OS shares a whole lot with consumer version etc. Not trying to troll - just my thoughts on something that I have always wondered - how Engineering culture varies between different successful software companies and to what effect.
- davedx 15y agoI don't know about Microsoft. Their road to software quality has been long and hard. Do you remember Windows 95? How many new Windows versions did they ship before they got anywhere near the stability and reliability of *nix systems? They're doing well these days, but it didn't happen overnight. Also, although I'm not defending anyone, I've never worked on an operating system before but I can imagine QA isn't a walk in the park.
- blinkingled 15y agoThat's exactly my point. They started off not so great and made mistakes on their way but if you look at how they evolved their Engineering practices in response to grave realities - the XP pre-SP2 security nightmare for instance, created a lot of positive Engineering changes at Microsoft and with Windows 7 they have made a lot of tangible progress in that area. OS QA is a pain - a huge one for Microsoft given the complexity and volumes involved. The pain is in dealing with unknowns and unpredictable combinations of thousands of different variables and what reaction it produces. But for something like authentication there must be standard testcases that are automatically executed and verified - blank password authentication, wrong password auth should all be standard test cases that are executed automatically and no software should go out the door until those basics are looking good.
- parfe 15y agoNews.YC community is being much kinder towards Apple than it acted towards Dropbox for identical security bugs. Dropbox even had the issue resolved in hours. I don't see anyone threatening to switch away from Apple or demanding an immediate personal response from Steve Jobs or ranting how this lapse is unforgivable. And you can't say it's because this bug only affects a small portion of Lion users as the Dropbox bug also only affected 100 accounts.
- dpcan 15y agoThis is how bullying works. If the victim is small and accessible, with their reputation on the line, you can put them in their place. When DropBox broke, the community pounced. Apple can't be bullied. With DropBox I can just cancel my membership and sign-up somewhere else. I'm not going to throw out my $1000+ Mac with $1000+ in software on it out the Window, right along with my livelihood of creating software for iOS. I'm not going to cancel my iPhone contract and pay hundreds in penalties too, and throw out all my apps and games and switch to Android. Not happening. They've got us by the balls here, we just have to let them fix this and move on.
- true_religion 15y agoIt's not bullying to tell people to fix security bugs. It's not bullying to use your own resources to entice (or force) them to do so in a timely manner. You're right that no one can threaten Apple and get action, but you're wrong in characterizing the threat as bullying.
- deleted 15y ago[deleted]
- tedunangst 15y agoThe dropbox bug only affected 100 people? Or it affected everyone but only 100 people logged in with it? That's a big difference.
- parfe 15y ago
- amazingman 15y agoI've seen this story in 4 or 5 places today and I still can't seem to find the details of the issue. Anyone have any links or info?
- alrs 15y agoSnow Leopard is the Windows 2000 of the NeXTSTEP operating systems, the best example of the series before the inevitable decline.
- codex 15y agoOpenLDAP is... kind of a piece of junk. I'm not surprised there are issues here. But again, who binds in cleartext?