Mac OS X Lion accepts any password when authenticating via LDAP

#1

Post by d0ne » Wed, Aug 24, 2011, 12:52 PM UTC

Mac OS X Lion accepts any password when authenticating via LDAP
forums.macrumors.com

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#2

Post by fredoliveira » Wed, Aug 24, 2011, 1:25 PM UTC

This looks both real and a pretty serious issue (I wonder how it went by almost a month without getting picked up by the security community). There's an discussion about it on Apple's own forums, linked below, but the gist of it is that users can authenticate over LDAP using any password using the login screen, and can't authenticate at all using su:

https://discussions.apple.com/message/15887083

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#3

Post by [deleted] » Wed, Aug 24, 2011, 1:46 PM UTC

[deleted]

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#4

Post by Hovertruck » Wed, Aug 24, 2011, 1:48 PM UTC

What alarms me is that on both of my computers with Lion, about half of the time just clicking on a name on the login screen works without entering the password. Happens on my friend's Lion install as well.

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#5

Post by brudgers » Wed, Aug 24, 2011, 1:48 PM UTC

Well, it is intended to be a lightweight protocol after all.

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#6

Post by smithian » Wed, Aug 24, 2011, 1:52 PM UTC

Can anyone confirm or deny that this is only an issue when authenticating to an OpenLDAP server (i.e. does it also affect authentication against Active Directory?) I will check it when I get to the office and update here. This could potentially be very serious.

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#7

Post by wgx » Wed, Aug 24, 2011, 1:53 PM UTC

Hovertruck wrote: post #4

What alarms me is that on both of my computers with Lion, about half of the time just clicking on a name on the login screen works without entering the password. Happens on my friend's Lion install as well.

I have authentication on after every screensaver and I've never been able to bypass the password. Weird.

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#8

Post by awakeasleep » Wed, Aug 24, 2011, 1:59 PM UTC

smithian wrote: post #6

Can anyone confirm or deny that this is only an issue when authenticating to an OpenLDAP server (i.e. does it also affect authentication against Active Directory?) I will check it when I get to the office and update here. This could potentially be very serious.

Active directory works as you'd expect.

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#9

Post by wuster » Wed, Aug 24, 2011, 2:13 PM UTC

Oh yikes. This deserves an update... yesterday. How can it be discovered and discussed only a month later?

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#10

Post by edtechdev » Wed, Aug 24, 2011, 2:36 PM UTC

There have long been issues with LDAP in Mac OS X. They don't use a standard version. It doesn't work with PHP's LDAP module. And there have long been security issues, too: PHP was often out of date with security vulnerabilities. So much so that our campus ended up blocking all Mac web servers.

Here are several other issues I wrote up a couple of years ago, the last time I was forced to use Mac OS X server: http://edtechdev.wordpress.com/2009/01/31/dont-use-mac-os-x-...