This is not so much a vulnerability as an oversight. Who's oversight is up to
you, but if you run a process remotely as root, and it has a GUI, then the GUI
will appear on the screen, as a root process. This usually involves a menubar,
adn thereby access to System Preferences. An easy demonstration is using SSH
to log into a box, sudo -s to get a root shell, and execute ANY program in the
applications directory (open -a Safari). You'll get Safari and access to the
menubar with the login window appearing as a hinderance. This isn't anything
new, the guy's using RADMIND have been fighting it since 10.4 came out and
redid the way the system handles the login window at startup. On the automated
side, applicatiosn like iHook have created a very nice work around for this.
At the ARD end, the lock screen function does this well enough. Its merely a
matter of testing deployment on a machine you have physical access to before
shoving it down to x-number of computers.
This is something John Welch (bynkii.com) harped about this spring. Its shoddy
design on many App Designers by not giving a proper remote installer or pkg
file that can execute silently. Whether or not this is something Apple needs
to fix, that's up for debate. They are not necessairly in the wrong here,
regardless of how much it may appear to be an obvious security flaw. Maybe
they should check to see if the LoginWindow is displayed before allowing a gui
app to run with root priviledges, but after debating this issue enough i've
come to the conclusion that Apple, the programmers, and the administrators, are
all at fault at some level.
