OS X Lion accepts any LDAP password, creates enterprise network nightmare

This is overhyped. The Lion client is storing the login information. It simply reuses the credentials on successive access to resources. The only way for a hacker to compromise security is to steal the Lion machine after the user authenticates... This is no different than someone standing behind you waiting for you to login and then swiping your computer.

Glad you all understand now.

To all of you people confused by the wording here it is simplified.

Typing any password in at the clinet after initial login and getting access does NOT mean that the password you typed in is what is being sent to the server. Rather the problem appears to be that regardless of typed in subsequent passwords, Lion is submitting your original and correct credentials for all subsequent logins regardless of the credentials you actually supply after the first login.

As a result this is a client issue not a server issue as the server is being given correct credentials regardless of what is typed in at the client.

This issue has been reported in public since several days and is a major f*ckup by Apple! You would expect that for such a huge security hole there would be a security fix within 24 hours - but it seems that iEnterprise doesn't (want to) sell that much... :/

Anybody seen a source for this *besides* that one forum thread at macrumors that everybody's linking to?

This is a bad bug. I can understand why there is confusion in the comments over whether the bug is 10.7 client or server. If we take the report (here and on The Reg) at face value, then the problem is with the way Lion persistently caches user credentials for LDAP servers.

However, I read this statement with surprise: ‘Speaking at the Black Hat security conference earlier this month, Stamos mentioned that iSec Partners had figured out an easy way to steal hundreds of passwords from enterprise servers by connecting a Mac to the network.’

Surely this is an indication of lack of security on the ‘enterprise servers’ rather than a problem inherent with OS X? Surely there shouldn’t be a way for any client (regardless of OS) to grab hundreds of passwords from an enterprise server?

Over the years using Leopard and Snow Leopard, i reported a similar problem to Apple (as i understand the problem to be). I was able to type in any word or even no word into the password authentication to access our company's client base and financial records. There was a password in place and yet I could simply bypass it using the iCal LDAP process. Seems like the bug is persistent.

The only email i have from the Apple Developer Connection team that i still have goes back to August of 2009 that indicated another LDAP issue with disconnecting... they fixed the one below with 10.7:

Problem
-Administrator password provided to access Active Directory at a work location
-Moved Computer to off-site location and have no access to work location Active Directory
-Tried to delete/disconnect work location Active directory connection from Directory Utility
-Prompted to give Administrator Password (IT staff)
-Do not have access to Administrator Password and thus ... no valid authentication
-Could not disconnect from Active Directory

Work around
-Clicked on Services
-Unchecked LDAPv3
-Connection to work location Active Directory disappeared
-Disconnected from Active Directory

quote:
Yuusharo
Considering that you have to successfully log in at least once on a Lion machine in order to produce the problem tells me that Lion is improperly caching credentials and reusing them in subsequent logins, whether or not they're correct. That would explain why this problem is localized only to Lion machines and not to a server vulnerability.

Lion is to blame, not the server.
----------------------------------------------------------------
Why would a cache containing my password allow me to get access to data that requires another person's credentials?

This is a rather confusing or confused article. As I understand it, LDAP and its variants (AD, Shibboleth, Keberos et. al.), are in sole control of access to that service. Either you present the correct credentials and get access or you do not and are barred from access. I'm further assuming that we are talking about Lion as a client and LDAP as any kind of non-Apple server. Unauthorized access is the server's fault, not the client's fault.

Or are we actually talking about LDAP running on a MacOS X 10.7 (Lion) server?

Please clarify.

Something is wrong with the description of the problem here. It's the LDAP server's responsibility to keep information secure, not the responsibility of the client OS. Even if the Lion client allows someone to log into the Mac, no enterprise data will be compromised unless a server allows it.

This was breaking news MID LAST WEEK. Impressive reporting TUAW.