Let's wait until Jon Gruber educates us that this is the right thing to do.
Mac OS X Lion accepts any password when authenticating via LDAP
11–20 of 89 posts
Re: Mac OS X Lion accepts any password when authenticating via LDAP
#12Can someone give a quick lowdown on what's really happening here? I am assuming the Lion client is connecting to an LDAP server using the provided password, and regardless of the response from LDAP, Lion proceeds with the login?
Re: Mac OS X Lion accepts any password when authenticating via LDAP
#13This looks both real and a pretty serious issue (I wonder how it went by almost a month without getting picked up by the security community). There's an discussion about it on Apple's own forums, linked below, but the gist of it is that users can authenticate over LDAP using any password using the login screen, and can't authenticate at all using su: https://discussions.apple.com/message/15887083
Not many people in the security community use Mac servers in such a way that they need LDAP, and of those people, very few are running Lion on their servers.
Re: Mac OS X Lion accepts any password when authenticating via LDAP
#14Says this is a solution: https://discussions.apple.com/message/15700245
Re: Mac OS X Lion accepts any password when authenticating via LDAP
#15What alarms me is that on both of my computers with Lion, about half of the time just clicking on a name on the login screen works without entering the password. Happens on my friend's Lion install as well.
I have never had that happen to me on all 3 of my Lion machines. Could you elaborate some more about your circumstances with this glitch?
Re: Mac OS X Lion accepts any password when authenticating via LDAP
#16What alarms me is that on both of my computers with Lion, about half of the time just clicking on a name on the login screen works without entering the password. Happens on my friend's Lion install as well.
I have authentication on after every screensaver and I've never been able to bypass the password. Weird.
Likewise. We're an all-Mac shop, we do semiregular audits of everyone's machines, and I've never seen this happen.
Re: Mac OS X Lion accepts any password when authenticating via LDAP
#17This looks both real and a pretty serious issue (I wonder how it went by almost a month without getting picked up by the security community). There's an discussion about it on Apple's own forums, linked below, but the gist of it is that users can authenticate over LDAP using any password using the login screen, and can't authenticate at all using su: https://discussions.apple.com/message/15887083
Not many people in the security community use Mac servers in such a way that they need LDAP, and of those people, very few are running Lion on their servers.
Wouldn't Mac clients need LDAP for authentification too?
Re: Mac OS X Lion accepts any password when authenticating via LDAP
#18First, this is a terrible bug. Shame on Apple for not rushing a fix, but...
Enterprises should not be doing immediate upgrades to any operating system, no matter how sparkly. I'm still waiting to upgrade my MacBook, and it's just me. No OS release goes off without a hitch (though there are some pretty impressive Linux releases!).
Re: Mac OS X Lion accepts any password when authenticating via LDAP
#19Well, it is intended to be a lightweight protocol after all.
Not sure why you are in gray. That's a really good joke.
Re: Mac OS X Lion accepts any password when authenticating via LDAP
#20What alarms me is that on both of my computers with Lion, about half of the time just clicking on a name on the login screen works without entering the password. Happens on my friend's Lion install as well.
[deleted]