Oh yikes. This deserves an update... yesterday. How can it be discovered and discussed only a month later?
Shows just how often its actually used in the wild.
Mac OS X Lion accepts any password when authenticating via LDAP
21–30 of 89 posts
Re: Mac OS X Lion accepts any password when authenticating via LDAP
#22Why are they not using Kerberos and SSL though? Does this affect those users who actually do take security seriously or just the bare bones implementations that aren't safe anyways?
Re: Mac OS X Lion accepts any password when authenticating via LDAP
#23This is only an issue when binding to an OpenLDAP server. There may be additional issues with LDAP on Lion server, but this problem as reported is an issue with Lion clients bound to servers running OpenLDAP without Kerberos or SSL.
Re: Mac OS X Lion accepts any password when authenticating via LDAP
#24There have long been issues with LDAP in Mac OS X. They don't use a standard version. It doesn't work with PHP's LDAP module. And there have long been security issues, too: PHP was often out of date with security vulnerabilities. So much so that our campus ended up blocking all Mac web servers. Here are several other issues I wrote up a couple of years ago, the last time I was forced to use Mac OS X server: http://ed…
If you're hosting PHP on a Mac, I'd hope you're using a package manager so that you're not depedent on Apple to update third party software. Perhaps they should be providing timely updates to third party items that they include, but depending on those updates is foolhardy.
Re: Mac OS X Lion accepts any password when authenticating via LDAP
#25First, this is a terrible bug. Shame on Apple for not rushing a fix, but... Enterprises should not be doing immediate upgrades to any operating system, no matter how sparkly. I'm still waiting to upgrade my MacBook, and it's just me. No OS release goes off without a hitch (though there are some pretty impressive Linux releases!).
In all fairness, someone has to be an early adopter, otherwise issues like this would go unnoticed.
I've no idea how complex a problem it is to fix, but it is worrying that it seems to be taking a while for Apple to fix it.
Re: Mac OS X Lion accepts any password when authenticating via LDAP
#26This looks both real and a pretty serious issue (I wonder how it went by almost a month without getting picked up by the security community). There's an discussion about it on Apple's own forums, linked below, but the gist of it is that users can authenticate over LDAP using any password using the login screen, and can't authenticate at all using su: https://discussions.apple.com/message/15887083
Not many people in the security community use Mac servers in such a way that they need LDAP, and of those people, very few are running Lion on their servers.
Are you saying that the fact that this issue doesn't effect many people means that it's not a serious security problem?
Re: Mac OS X Lion accepts any password when authenticating via LDAP
#27Earlier quoted context omitted.
Not many people in the security community use Mac servers in such a way that they need LDAP, and of those people, very few are running Lion on their servers.
Are you saying that the fact that this issue doesn't effect many people means that it's not a serious security problem?
He's saying that since the issue doesn't affect many people it didn't get found right away. It is a serious security problem for businesses that use Mac OS X with LDAP. However, it's not a serious security problem for me.
Re: Mac OS X Lion accepts any password when authenticating via LDAP
#28First, this is a terrible bug. Shame on Apple for not rushing a fix, but... Enterprises should not be doing immediate upgrades to any operating system, no matter how sparkly. I'm still waiting to upgrade my MacBook, and it's just me. No OS release goes off without a hitch (though there are some pretty impressive Linux releases!).
In all fairness, someone has to be an early adopter, otherwise issues like this would go unnoticed. I've no idea how complex a problem it is to fix, but it is worrying that it seems to be taking a while for Apple to fix it.
I think you are missing the point that the gp is making; any enterprise that this would affect should not be provisioning it to the servers/clients until they test it on a smaller scale. This issue would be found during the normal testing channels of enterprise adoption.
Re: Mac OS X Lion accepts any password when authenticating via LDAP
#29Oh yikes. This deserves an update... yesterday. How can it be discovered and discussed only a month later?
Only happens if OpenLDAP is not secured by Kerberos or SSL... I don't see this as very common in the first place (ie, cleartext over the wire for auth?!).
Re: Mac OS X Lion accepts any password when authenticating via LDAP
#30First, this is a terrible bug. Shame on Apple for not rushing a fix, but... Enterprises should not be doing immediate upgrades to any operating system, no matter how sparkly. I'm still waiting to upgrade my MacBook, and it's just me. No OS release goes off without a hitch (though there are some pretty impressive Linux releases!).
I had to upgrade to continue using the latest Xcode, although I'm not running that on Server.