Matt Johnston has discovered a security issue in Mac OS X, which can be exploited by malicious, local users to gain knowledge of potentially sensitive information.

The problem is that non-setuid root applications can't change the permissions of ptys. This can be exploited to sniff other users' ttys opened via non-setuid root applications (e.g. screen).

The security problem has been confirmed in version 10.3.9. Prior versions may also be affected.

Solution
The security problem has reportedly been fixed in version 10.4.

Provided and/or discovered by
Matt Johnston

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area