Apple offers DHCP security workaround

By Peter Cohen

December 3, 2003 12:00 PM ET

Macworld - It's been recently noted that Mac OS X can be susceptible to a security problem involving malicious DHCP servers. The chances of the security issue affecting Mac users en masse is miniscule, but Apple Computer Inc. has posted details to its online Knowledgebase explaining how to circumvent potential problems.
According to a report from Carrel.org, a malicious response from a Dynamic Host Configuration Protocol (DHCP) server can grant root access on various versions of Mac OS X. DHCP is commonly used as an easy way to provide users on a network with TCP/IP addresses.
"In many cases, your Mac is protected from this kind of exploit because the malicious DHCP server has to be part of your local network, or 'subnet,'" said Apple in its recent tech note. "If your computers are the only ones on your local network and you have a broadband connection (DSL or cable service) with a Network Address Translation device -- such as an AirPort Base Station -- this exploit is not possible."
Carrel.org disputes that claim. "If you have not secured your network (especially a wireless network) against malicious devices connecting to it, you can be exploited even if you are using NAT since the attack happens behind the NAT on your local subnet," said William Carrel.
That chain of events would require someone to set up or hack a DHCP server on an exposed wireless network -- one with no password, for example, or one whose password had been compromised.
Regardless, Apple has offered steps that users concerned with this issue can take to make sure their Macs can't be exploited in this way. Steps include making sure that LDAP-based directory services are turned off, or making sure that search parameters for directory services are changed.

Reprinted with permission from

For more Macintosh news, visit Macworld.com.
Story copyright 2009 Mac Publishing, LLC. All rights reserved.

Recommend Digg Twitter ShareThis

Email Print Send Feedback Reprints

Additional Resources

Xerox

Win a color printer!

By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!

Microsoft

Upgrade to Internet Explorer 8 today.

Save time and mitigate security risk. Deploy it now.

Sybase

NEXT-GENERATION MOBILITY PLATFORMS

In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

White Papers & Webcasts

Accelerate SSL Encrypted Applications
The amount of SSL traffic is growing in the enterprise. Because it is encrypted, it cannot be properly controlled and accelerated. Blue Coat...

Usability Is Everything
Learn what sets Workday's HR and Payroll solutions apart from the competition....

ESG Lab Field Audit
Many companies have successfully implemented Riverbed WAN optimization solutions within their Cisco networks. This ESG Lab Field Audit document explores the success that...

The Value of Real SaaS at Workday
Cost savings, speed to value, and innovation brought to the enterprise by Workday's software-as-a-service solutions for HR and Payroll....

Shape Your Apps Strategy to Reflect New SaaS Licensing and Pricing Trends
Why are smart companies choosing software-as-a-service? Find out in the complimentary Forrester Research report...

SaaS at Flextronics, Inc.
Dave Smoley, CIO of Flextronics, discusses the real value of software-as-a-service and why he chose Workday for his HR solution....

Natural User Interface for Enterprise Applications
Learn how a revolutionary user interface can make a complex enterprise application so intuitive even casual users can jump right in....

Why Compliance Pays
This OnDemand webcast explores the relationship that firms with best compliance records have higher revenue, greater customer retention, lower financial losses from data...

A Truly Global HCM System
Learn about a system built with advanced object-oriented technology that support multi-national requirements and costs less to implement, maintain and upgrade....

Agile Enterprise Content Management (ECM) for Rapid ROI
Find out how combining ECM and BPM will help adress issues about content rich business processes....

All White Papers | All Webcasts