PDA

View Full Version : Possible security hole?



SC68Cal
Oct 17, 2006, 10:20 PM
I might have found at least, an itsy bitsy hole.

Normally a user without administrator privs. cannot add items to the /Applications directory without the authenticating with an Admin account. However, in terminal, someone can invoke rm <folder> into /applications without having to authenticate.


glib
Oct 17, 2006, 10:59 PM
I can also rm -R something in /Applications with my normal user account. However, I can also copy to applications with my normal user account just fine. Permissions are the same for me.
SC68Cal
Oct 18, 2006, 12:59 AM
Meaning you don't need to authenticate to add programs to /Applications via Finder as a standard user?
beatsme
Oct 18, 2006, 09:23 AM
I might have found at least, an itsy bitsy hole.

Normally a user without administrator privs. cannot add items to the /Applications directory without the authenticating with an Admin account. However, in terminal, someone can invoke rm <folder> into /applications without having to authenticate.

report it to Apple. See what they say.
bearbo
Oct 18, 2006, 09:35 AM
i think it depend on what your privilage is... im not sure

also, i think u can add small simple drag into app folder apps... if not to the root app folder, at least to user app folder...
MacBoobsPro
Oct 18, 2006, 09:37 AM
If you think you have found something iffy. Dont post it on a forum, keep it quiet and tell Apple. :rolleyes:
scottlinux
Oct 18, 2006, 12:08 PM
This is not a security hole. These are standard permissions in OS X.
SC68Cal
Oct 18, 2006, 12:17 PM
Okay. I've tried to replicate what I did last night with just a normal folder. I was given a permission denied error.

I'm going to retrace what exactly allowed me to move the program "John The Ripper" into the Applications folder from my Standard Account.

Currently, the permissions for the John folder

Owner = Standard Account
Access = R & W

Group = Admin
Access = R & W

Others = No Access

I'm beginning to wonder if that since I compiled John with my admin account, that is what allowed it to be moved.
ddekker
Oct 18, 2006, 03:09 PM
ROFLOL... I love the "its not a hole.. its a feature"... lol.. if it were MS it would be all over the news...

D
gauchogolfer
Oct 18, 2006, 03:20 PM
ROFLOL... I love the "its not a hole.. its a feature"... lol.. if it were MS it would be all over the news...

D

Who the heck has made this comment? Honestly.

The OP even reported that he has some admin privileges on the account, and the other posters suggested reporting it to Apple.

Sheesh :rolleyes: