Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mac OS X Lion accepts any password when authenticating via LDAP

forums.macrumors.com

Post reply on HN
Print view View original

41–50 of 89 posts

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#41

Post by davedx »

blinkingled wrote: post #40

Tells you something about Apple's testing methodology. QA team at Apple must be playing real fast and loose. Being affected by 3 serious regressions in Lion (all filed as bugs and Apple closed them as duplicates, btw) - I get the feeling that Apple could do better at software engineering. (Alarms on iOS if you are still not convinced :) Just the fact that they release software that allows authentication without corre…

I don't know about Microsoft. Their road to software quality has been long and hard. Do you remember Windows 95? How many new Windows versions did they ship before they got anywhere near the stability and reliability of *nix systems?

They're doing well these days, but it didn't happen overnight.

Also, although I'm not defending anyone, I've never worked on an operating system before but I can imagine QA isn't a walk in the park.

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#42

Post by a2tech »

matsur wrote: post #34
a2tech wrote: post #23

This is only an issue when binding to an OpenLDAP server. There may be additional issues with LDAP on Lion server, but this problem as reported is an issue with Lion clients bound to servers running OpenLDAP without Kerberos or SSL.

Your use of the word "only" here is misplaced. This is a very serious security issue that affects clients connecting to OpenLDAP.

Indeed-for users that are bound to OpenLDAP its a massive issue. Without knowing those users exact setup its hard to know exactly what the issue is-the fact that its ONLY OpenLDAP servers is odd. The client must be receiving some sort of authentication succeeded message (you will note that it won't accept a blank password-so in that case OpenLDAP is responding with a failure). It may be a bug in Lion that triggers a bug in OpenLDAP.

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#43

Post by a2tech »

city41 wrote: post #12

Can someone give a quick lowdown on what's really happening here? I am assuming the Lion client is connecting to an LDAP server using the provided password, and regardless of the response from LDAP, Lion proceeds with the login?

No-if you try to submit a blank password it is (rightly) rejected. If you submit a non-blank password, the login succeeds. This (to me) points to the LDAP server responding with a login success message and the OS allowing the user in. This bug appears to only effect Lion clients talking to OpenLDAP (not the LDAP server shipped with Lion Server) or Active Directory.

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#44

Post by MostAwesomeDude »

tptacek wrote: post #13
fredoliveira wrote: post #2

This looks both real and a pretty serious issue (I wonder how it went by almost a month without getting picked up by the security community). There's an discussion about it on Apple's own forums, linked below, but the gist of it is that users can authenticate over LDAP using any password using the login screen, and can't authenticate at all using su: https://discussions.apple.com/message/15887083

Not many people in the security community use Mac servers in such a way that they need LDAP, and of those people, very few are running Lion on their servers.

It wasn't your bug to find, it was Apple's, and they should have found it far sooner.

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#45

Post by blinkingled »

davedx wrote: post #41
blinkingled wrote: post #40

Tells you something about Apple's testing methodology. QA team at Apple must be playing real fast and loose. Being affected by 3 serious regressions in Lion (all filed as bugs and Apple closed them as duplicates, btw) - I get the feeling that Apple could do better at software engineering. (Alarms on iOS if you are still not convinced :) Just the fact that they release software that allows authentication without corre…

I don't know about Microsoft. Their road to software quality has been long and hard. Do you remember Windows 95? How many new Windows versions did they ship before they got anywhere near the stability and reliability of *nix systems? They're doing well these days, but it didn't happen overnight. Also, although I'm not defending anyone, I've never worked on an operating system before but I can imagine QA isn't a walk…

That's exactly my point. They started off not so great and made mistakes on their way but if you look at how they evolved their Engineering practices in response to grave realities - the XP pre-SP2 security nightmare for instance, created a lot of positive Engineering changes at Microsoft and with Windows 7 they have made a lot of tangible progress in that area.

OS QA is a pain - a huge one for Microsoft given the complexity and volumes involved. The pain is in dealing with unknowns and unpredictable combinations of thousands of different variables and what reaction it produces.

But for something like authentication there must be standard testcases that are automatically executed and verified - blank password authentication, wrong password auth should all be standard test cases that are executed automatically and no software should go out the door until those basics are looking good.

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#46

Post by tptacek »

MostAwesomeDude wrote: post #44
tptacek wrote: post #13

Earlier quoted context omitted.

Not many people in the security community use Mac servers in such a way that they need LDAP, and of those people, very few are running Lion on their servers.

It wasn't your bug to find, it was Apple's , and they should have found it far sooner.

Who are you talking to? Me? Did you read the comment thread? I'm not sure who you're arguing with, or why you picked me for this reply.

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#47

Post by Sidnicious »

tptacek wrote: post #13
fredoliveira wrote: post #2

This looks both real and a pretty serious issue (I wonder how it went by almost a month without getting picked up by the security community). There's an discussion about it on Apple's own forums, linked below, but the gist of it is that users can authenticate over LDAP using any password using the login screen, and can't authenticate at all using su: https://discussions.apple.com/message/15887083

Not many people in the security community use Mac servers in such a way that they need LDAP, and of those people, very few are running Lion on their servers.

I wasn't entirely clear from the link — Are Lion servers not being picky about passwords, or are Lion clients not being picky about LDAP authentication failing (hence not being able to mount the user's home folder)?

If the latter, the impact is bad, but not as bad (you'll be able to get access to the machine you're sitting at, but not to any server-side resources).

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#48

Post by parfe »

News.YC community is being much kinder towards Apple than it acted towards Dropbox for identical security bugs. Dropbox even had the issue resolved in hours.

I don't see anyone threatening to switch away from Apple or demanding an immediate personal response from Steve Jobs or ranting how this lapse is unforgivable.

And you can't say it's because this bug only affects a small portion of Lion users as the Dropbox bug also only affected 100 accounts.

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#49

Post by amazingman »

authorityaction wrote: post #38
awakeasleep wrote: post #8

Earlier quoted context omitted.

Active directory works as you'd expect.

We just got some Lion iMacs and have not been able to keep them connected to the AD. It doesn't work as expect unfortunately.

Are you talking about the "Network accounts unavailable" red light? If you wait ~20secs, it generally resolves itself. Definitely a bug, but just an annoying one.

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#50

Post by niels_olson »

a2tech wrote: post #23

This is only an issue when binding to an OpenLDAP server. There may be additional issues with LDAP on Lion server, but this problem as reported is an issue with Lion clients bound to servers running OpenLDAP without Kerberos or SSL.

which is possibly quite a few university macs in libraries and computer labs.
Post reply on HN