Still enjoying Apple’s latest operating system on your Mac? With over 250 new features for $29.99, most of us couldn’t be happier with the upgrade… until we find out that our Macs are now at risk from a major vulnerability in OS X Lion.
The issue should be a concern to anyone who uses OS X Lion, but it’ll be most worrying to the enterprise environment, according to security firm Errata Security. The vulnerability is related to Lightweight Directory Access Protocol (LDAP), and allows a person to use any password to get past Lion’s initial login process.
Rob Graham, CEO of Errata Security, told MacNN:
“Once we own an LDAP server we own everything. I can walk up to any laptop (in an organization) and log into it.”
The issue was apparently discovered well before OS X 10.7.1 was released, but is still present in the latest release — begging the question of why this wasn’t patched before the first Lion update went public. It’s unclear whether the issue has been fixed in 10.7.2, which is already being developed by Apple and has been released to developers as a beta, but we’re guessing that now it’s been made famous Apple will promptly do something about it.
So what do we do in the meantime? Well, according to MacNN, steer clear of Lion:
In the meantime, some security experts and enterprise IT staff are advising against using Lion Macs, at least in large numbers. The problem is said to be restricted to Macs upgraded to Lion, though, and protocols that compete with LDAP appear to be safe.
