Widget security worries dog Apple

TalkBack 17 of 51:

Next »

« Previous

• Thread View
• Flat View

What?

"Read the article dude."

My post was about the poor quality of the journalism. The
article, based on a post to an unmoderated mailing list, is
not a good source.

"Only until the user then logs in as admin. After the user
does that, the widget has full control of the machine."

If the user is a member of the admin group then any code,
or widget, will have admin group privileges, which includes
the ability to run sudo. If the user, or a user's process,
executes sudo then other processes are able to use the
elevated permissions due to the configuration of sudo in
MacOSX.

If the user isn't (ie just a member of staff) then s/he will run
in the restricted environment and doesn't have access to
sudo (removing this "vulnerability" and many others).

If a restricted user requires temporary administrator
permissions (eg like running "Software Update") then that
process makes calls via [url=http://developer.apple.com/
documentation/Security/Conceptual/
authorization_concepts/index.html#//apple_ref/doc/uid/
TP30000995]Authorization Services[/url].

Hope this helps.

Posted by: Richard Flude   Posted on: 05/22/05 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Five Steps to Determine When to Virtualize YourServers VMware Server virtualization isn't just for big companies. Entry-level ... Download Now
• Why Isn't Server Virtualization Saving Us More? A Few Small Changes May Dramatically Increase Your Efficiency VMware Companies have rapidly adopted server virtualization over the past few ... Download Now
• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now