TUCoPS :: Macintosh :: ease3.htm

At Ease networking security bugs

    At Ease


    At Ease 5.0 (Mac)


    Tim Conrad  found following.   At Ease  5.0 will  allow a  user to
    access any user's volume on the server.  The tested  configuration
    is as follows:

        MacOS 7.6.1 (should work with anything greater than 7)
        At Ease 5.0.2
        AppleShare IP 5.0.3
        Netscape 4.0.7 (No reason it shouldn't work from .99 to 4.5)

    How to  do it?   Log in  as any  user that  has access to Netscape
    Communicator, and type in


    and you are able  to access the disk.   Do the same thing,  except


    and  it's  quite  easy  to  browse  through  anyones files.  It is
    possible  to  download  files  from  that users directory.  You're
    unable to actually open any of the files once they are downloaded,
    however in an educational setting, just viewing names in a certian
    directory could  constitute some  serious problems  (such as  if a
    teacher works with Special Education  studends, and has a list  of
    documents to their parents).


    Apple apparently will  not fix their  own product. There  is a 3rd
    party extention available for this at:


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH