Possible Issue with Netinfo and Mac OS X

From: Benjamin Gardiner (cvisors@off-fw.tved.net.au)
Date: Sun Sep 02 2001 - 19:22:50 PDT

  • Next message: snsadvat_private: "[SNS Advisory No.41] iPlanet Messaging Server 5.1(evaluation copy) Buffer Overflow Vulnerability" 

    Hi,
	I have been using Mac OS X for quite a while now, and I have just
found something that concerns me a little.
	As you probably know Mac OS X is based on BSD and by default does
not have any services running (though it is not hard to turn these on)
thefore is reasonably secure out of the box.
	Now as you may be aware one of the major differnces in the way Mac
OS X deals with some information, for example the password file in /etc is
there but not used.  Such things are taken care of via netinfo.
	Anyway to get to the core of the matter, I was looking through the
file structure, looking at some of the config files, and such, when I
happened to look in /var/backups in var/backups there was one file called:
"local.nidump"

This is a file which contains from what I can tell a fair part if not all
of the information stored in the netinfo database, including users and
passwords.

Here is the information for a user I created for this purpose:

          "_shadow_passwd" = ( "" );
          "_writers_passwd" = ( "test" );
          "hint" = ( "" );
          "uid" = ( "502" );
          "_writers_hint" = ( "test" );
          "gid" = ( "20" );
          "realname" = ( "test" );
          "name" = ( "test" );
          "passwd" = ( "Fnh1eLU0U6o12" );
          "shell" = ( "/bin/tcsh" );
          "home" = ( "/Users/test" );
          "sharedDir" = ( "Public" );


The issue is that my user "test" was created without the option to
administer the system (by default root isn't enabled in Mac OS X.)  This
user though could access and copy and read this file, via a shell and also
via ftp (please note again things like ssh and ftp are not started by
default they have to be enabled in sharing under system preferences.

As I see it and please correct me if I am wrong here, it is a bad idea to
have such a file acessable to any user of the system, especially since the
average mac user most likley doesn't understand things as permisions and
the dangers of having things like ssh, telnet, and ftp  open and giving
people access to such things, also when a user does enable these services
there are no warnings that mention the security issues whith said
services.

Anyway, I hope I am not reading too much into this.

Regards,

Benjamin Gardiner

    This archive was generated by hypermail 2b30 : Sun Sep 02 2001 - 22:20:32 PDT