fscklog

Sicherheitslücke: Gefälschte Authentifizierungsdialoge

Wie Alastair Houghton in seinem Blog darlegt, sollte den Authentifizierungsdialogen in OS X kein allzu großes Vertrauen geschenkt werden. Offenbar ist der Name des Passwort-Eingabe erfordernden Programms nämlich problemlos zu fälschen.

«Very funny, but quite scary because it means it's much too easy to trick an end-user into giving a potentially malicious program root privileges. Apple have been widely—and, to my mind, rather unfairly—lambasted for their attitude towards security holes, but in this case I'm sorry to report that the critics are quite correct. I'm sure they'll fix this now I've published it on the Internet, but I really shouldn't have had to do this; it should have been fixed back in 2003 when it was first reported.» (Danke, Thomas!)

Kommentare

You can follow this conversation by subscribing to the comment feed for this post.

Sicherheitslücke: Gefälschte Authentifizierungsdialoge

Wie Alastair Houghton in seinem Blog darlegt, sollte den Authentifizierungsdialogen in OS X kein allzu großes Vertrauen geschenkt werden. Offenbar ist der Name des Passwort-Eingabe erfordernden Programms nämlich problemlos zu fälschen.

«Very funny, but quite scary because it means it's much too easy to trick an end-user into giving a potentially malicious program root privileges. Apple have been widely—and, to my mind, rather unfairly—lambasted for their attitude towards security holes, but in this case I'm sorry to report that the critics are quite correct. I'm sure they'll fix this now I've published it on the Internet, but I really shouldn't have had to do this; it should have been fixed back in 2003 when it was first reported.» (Danke, Thomas!)