Slashdot Mirror
Security Update Fixes the Screen Effects Hole
jellomizer writes "Here is is. Available from Software Update. 'Security Update 2003-07-14 addresses a potential vulnerability when a password is required upon waking from the Screen Effects feature, which could allow an unauthorized user access to the desktop of the logged in user.'
Now we can use our screen savers with the warm and fuzzy secure feeling."
i just hope that one day updates won't require a restart.
is is? I cannot seem to find "is". I feel so lost!
Sure can tell its Monday afternoon - editors are still recovering from the weekend
Could pudge or jellomizer please post a hyperlink? Thanks!
It's unclear from the docs whether this fixes just the problem of the screensaver dumping you back into a session without the password, or whether this addresses the buffer overflow that could cause other applications to crash, including the login window.
Anybody have any idea what files this updates and what version it updates those files to?
I know that you can gain access to my machine by rebooting and changing the root password. I know that you can get around the open-firmware protection. I know that a screen saver doesn't protect my hard drive from someone opening my machine and taking it... but I am still very thankful for this update. Why? Because I encrypt my entire home directory. (Via the method I mentioned here a while ago). So, the "lock screen" option is very important to me -- If you reboot my machine, my home directory is once again encrypted. So the Screen Saver password does have it's place.
Apple's page for the update, if you prefer to download manually.
I don't notice a performance hit while using the files in my home directory (I don't keep MP3s there however). You can monitor the amount of CPU that is being used decrypting files by checking the CPU usage of the 'hdid' process in top or the CPU monitor. But I encrypt my home directory (as you suggested) to protect my Library, financial records, my code, and the files for my business which I use all the time. My desktop (my download folder) is encrypted and I don't notice a performance hit while downloading. (I'm running a Dual 500 MHz machine, should you care)
In which case, Apple should have named this patch as a patch to Cocoa itself instead of simply the screensaver.
Trying to reduce the public's perception of the problem are we Apple?
Just think, a Cocoa buffer overflow still isn't as bad as Windows' shatter attacks.
I'm not convinced there was ever a general cocoa problem.
Obviously, there was the screensaver bug, and I reproduced that myself.
Other people mentioned a problem with the login window. I've noticed before if I type an incorrect password it drops to a text-console. This is what people observed when trying to overflow the login window. It's certainly not an exploit.
I tried overflowing text fields in safari and mail, without incident.
If someone really found another app that was affected as the screensaver was, I'd really like to hear about it.
Unless someone does, I'll give apple the benefit of the doubt. They fixed the problem, no harm no foul.
You say
I dont really see this as that much of a problem.
So instead you power cycle the laptop, hold down S durring boot to enter single user mode.
At this point you do technically have root, although without a GUI.
Change target accounts password, reboot, login.
If you have a password set in openfirmware to prevent single user mode boots, I have to zap the pram 3 times and the password is gone.
Granted this is a whole lot harder than breaking the screen saver, but still, any computer someone can get physical access to is not secure under any conditions.
There is also a fresh iDVD software update today as well. Rumored to fix the "I don' wanna!!!" message...something about multiplexing :)
No restart needed!!
Just Hide it. Then it's out of the way but still in the Dock reminding you that you eventually should restart.
This is a [lame] local user access hack/exploit. No big deal. Why fix it? They should ignore the problem. If enough people complain then it's not a bug, it's a _feature_. Has the moon gone red?
Oh, wait, I stopped using Microsoft products. Sorry.