<<< Date Index >>>     <<< Thread Index >>>

Re: Re: Apple Remote Desktop root vulneravility



This is not so much a vulnerability as an oversight.  Who's oversight is up to 
you, but if you run a process remotely as root, and it has a GUI, then the GUI 
will appear on the screen, as a root process.  This usually involves a menubar, 
adn thereby access to System Preferences.  An easy demonstration is using SSH 
to log into a box, sudo -s to get a root shell, and execute ANY program in the 
applications directory (open -a Safari).  You'll get Safari and access to the 
menubar with the login window appearing as a hinderance.  This isn't anything 
new, the guy's using RADMIND have been fighting it since 10.4 came out and 
redid the way the system handles the login window at startup.  On the automated 
side, applicatiosn like iHook have created a very nice work around for this.  
At the ARD end, the lock screen function does this well enough.  Its merely a 
matter of testing deployment on a machine you have physical access to before 
shoving it down to x-number of computers.  

This is something John Welch (bynkii.com) harped about this spring.  Its shoddy 
design on many App Designers by not giving a proper remote installer or pkg 
file that can execute silently.  Whether or not this is something Apple needs 
to fix, that's up for debate.  They are not necessairly in the wrong here, 
regardless of how much it may appear to be an obvious security flaw.  Maybe 
they should check to see if the LoginWindow is displayed before allowing a gui 
app to run with root priviledges, but after debating this issue enough i've 
come to the conclusion that Apple, the programmers, and the administrators, are 
all at fault at some level.