OS X Lion bugs let hackers view, change local user passwords

The latest version of OS X Lion allows any user to easily change the password of any local account, due to permissions oversights on Apple's part. The news comes less than a month after another Lion vulnerability that let users bypass LDAP without a password gained notoriety.

Originally reported by Defence in Depth blogger Patrick Dunstan, the root of the newly discovered problem in Mac OS X 10.7 is tied to the user-specific shadow files used in modern OS X platforms. These files are essentially hash databases and contain, among other things, the user's encrypted passwords. Ideally, they should be accessible only via high-privilege accounts.

According to Dunstan, Apple dropped the ball in terms of how Lion handles privilege. "Whilst non-root users are unable to access the shadow files directly, Lion actually provides non-root users the ability to still view password hash data," Dunstan wrote. "This is accomplished by extracting the data straight from Directory Services." Any user can accomplish this trick by simply invoking the directory services listing using the /Search/ path -- for example, $ dscl localhost -read /Search/Users/bob (where "bob" is the username). This causes Lion OS X to spew out the contents of Bob's shadow hash file, including data that can be used to crack Bob's password with a simple script, such as a Python script written by Dunstan.