at.ease.5.0.txt

`Date: Thu, 13 May 1999 09:37:57 -0600  
From: Tim Conrad <[email protected]>  
To: [email protected]  
Subject: At Ease 5.0 Security Hole  
  
<it helps when you finish your message before hitting the 'send' button>  
  
  
Hello;  
  
At Ease 5.0 will allow a user to access any user's volume on the server.  
  
The tested configuration is as follows:  
  
MacOS 7.6.1 (should work with anything greater than 7)  
At Ease 5.0.2  
AppleShare IP 5.0.3  
Netscape 4.0.7 (No reason it shouldn't work from .99 to 4.5)  
  
How to do it.  
  
Log in as any user that has access to Netscape Communicator, and type in  
file://Macintosh%20HD/System%20Folder/ and you are able to access the disk.  
  
Do the same thing, except use  
file://At%20Ease%20Volume%20Name/At%20Ease%20%Docs/username and it's quite easy  
to browse through anyones files.  
  
It is possible to download files from that users directory. I have been unable  
to actually open any of the files once they are downloaded, however in an  
educational setting, just viewing names in a certian directory could constitute  
some serious problems (such as if a teacher works with Special Education  
studends, and has a list of documents to their parents).  
  
Apple apparently will not fix their own product. There is a 3rd party extention  
available for this at: http://www.ncal.verio.com/~lsr/programs/MSIENoServers.hqx  
  
  
  
Tim Conrad  
  
---------------------------------------------------------------------------------  
  
Date: Fri, 14 May 1999 18:48:37 -0700  
From: Vincent Janelle <[email protected]>  
To: [email protected]  
Subject: Re: At Ease 5.0 Security Hole  
  
This is not an apple problem mostly, its an MSIE problem.  
  
Hell, is At Ease still supported? Its just a replacement finder as far as  
I know, it doesn't do things like replace fs drivers and patch binaries to  
stop things like that.  
  
------------  
If you have any trouble sounding condescending, find a Unix user to show  
you how it's done. -Scott Adams  
--http://random.gimp.org --mailto:[email protected] --UIN 23939474  
  
On Thu, 13 May 1999, Tim Conrad wrote:  
  
> Apple apparently will not fix their own product. There is a 3rd party extention  
> available for this at: http://www.ncal.verio.com/~lsr/programs/MSIENoServers.hqx  
>  
>  
>  
> Tim Conrad  
>  
  
`