Techsurvivors

Archives => 2009 => Topic started by: Paddy on November 09, 2009, 04:44:14 PM

Title: Apple releases 10.6.2
Post by: Paddy on November 09, 2009, 04:44:14 PM

http://www.macworld.com/article/143743/200...l?lsrc=rss_news



Combo update

Title: Apple releases 10.6.2
Post by: Xairbusdriver on November 09, 2009, 04:56:57 PM

Thank! Getting the manual updater as I write.

Title: Apple releases 10.6.2
Post by: Shades of Gray on November 09, 2009, 06:42:45 PM

Downloaded over supper. Just restarted. Everything seems OK.

Title: Apple releases 10.6.2
Post by: krissel on November 11, 2009, 12:39:51 AM

Thought this was interesting:

QUOTE

Login Window
CVE-ID:  CVE-2009-2836
Available for:  Mac OS X v10.6 and v10.6.1,
Mac OS X Server v10.6 and v10.6.1
Impact:  A user may log in to any account without supplying a
password
Description:  A race condition exists in Login Window. If an account
on the system has no password, such as the Guest account, a user may
log in to any account without supplying a password. This update
addresses the issue through improved access checks. This issue does
not affect systems prior to Mac OS X v.10.6.

Details on the update/security release:

http://lists.apple.com/archives/security-a...v/msg00000.html

Title: Apple releases 10.6.2
Post by: Xairbusdriver on November 11, 2009, 01:19:21 PM

QUOTE

If an account on the system has no password, such as the Guest account, a user may
log in to any account without supplying a password.

OK, what would be the expected behavior, in this case? "If someone approaches a group of doors, without a locks, such as a front door, he may enter any of the doors without knocking." Pretty much... Next?

Title: Apple releases 10.6.2
Post by: rongold on November 11, 2009, 02:55:34 PM

No problems with update, using Combo updater. Most noticeable improvement: checking permissions with disk utility has been accelerated enormously. Also as fast as it used to be in Tiger.

Title: Apple releases 10.6.2
Post by: krissel on November 12, 2009, 12:06:33 AM

QUOTE(Xairbusdriver @ Nov 11 2009, 02:19 PM) <{POST_SNAPBACK}>

QUOTE

If an account on the system has no password, such as the Guest account, a user may
log in to any account without supplying a password.

OK, what would be the expected behavior, in this case? "If someone approaches a group of doors, without a locks, such as a front door, he may enter any of the doors without knocking." Pretty much... Next?

Jim, it went farther than that.  Having any account on the system with no password allowed any other account to be accessed as well. It basically negated any passwords placed on other accounts.  

Title: Apple releases 10.6.2
Post by: Xairbusdriver on November 12, 2009, 01:14:39 PM

Well, I would certainly have worded it differently. if I understand what you are saying the article said, one could log into AN account, that had no password, and then log into ANY OTHER account, if that other account has a password! I really find that hard to believe and that it hasn't been made more widely known before now. even if it only became available with Snow Leopard!

Perhaps I read things too literally and not without enough consideration, and Obviously without enough investigation of your links! I would test the info but I don't have any accounts without a password and I've have several errands that I should be running! But thanks for the information, I plan on sharing that at our MUG meeting next week, where we will be hosting an Apple Systems Engineer.