Apple PowerBook Password Security Control Panel Vulnerability
BID:532
Info
Apple PowerBook Password Security Control Panel Vulnerability
| Bugtraq ID: | 532 |
| Class: | Design Error |
| CVE: |
CVE-1999-1393 |
| Remote: | No |
| Local: | Yes |
| Published: | May 21 1999 12:00AM |
| Updated: | Jul 11 2009 12:56AM |
| Credit: | From an article at http://www.securemac.com by mSec. |
| Vulnerable: |
Apple Mac OS 8 8.6 Apple Mac OS 8 8.5 |
| Not Vulnerable: | |
Discussion
Apple PowerBook Password Security Control Panel Vulnerability
Powerbooks come with a 'Password Security' Control Panel. This allows the user to create a password that must be entered prior to the OS mounting the hard drive. This feature can be enabled or disabled by the user. The control panel stores the enabled/disabled state, as well as an encrypted verion of the password, in a file called 'aaaaaaaaAPWD' in the root of the drive. The problem is that this security feature can be bypassed with a boot disk and hard drive utility.
Powerbooks come with a 'Password Security' Control Panel. This allows the user to create a password that must be entered prior to the OS mounting the hard drive. This feature can be enabled or disabled by the user. The control panel stores the enabled/disabled state, as well as an encrypted verion of the password, in a file called 'aaaaaaaaAPWD' in the root of the drive. The problem is that this security feature can be bypassed with a boot disk and hard drive utility.
Exploit / POC
Apple PowerBook Password Security Control Panel Vulnerability
Boot the laptop from an emergency startup disk. The password dialog will appear. Select 'Cancel'. The laptop will be usable, but the hard drive and it's contents will not. However, Norton Disk Editor can be used even on unmounted drives. Using it or a comparable product, change the byte at offset 3 of the 'aaaaaaaaAPWD' file from 01 to 00 to disable the security feature. Reboot from the hard drive.
Boot the laptop from an emergency startup disk. The password dialog will appear. Select 'Cancel'. The laptop will be usable, but the hard drive and it's contents will not. However, Norton Disk Editor can be used even on unmounted drives. Using it or a comparable product, change the byte at offset 3 of the 'aaaaaaaaAPWD' file from 01 to 00 to disable the security feature. Reboot from the hard drive.
References
Apple PowerBook Password Security Control Panel Vulnerability
References:
References:
- Apple Powerbooks Security Control Panel (Macintosh Security)