I'm disappointed the post doesn't mention any appropriate disclosure to Apple prior to publication. Sure, it's not an out-right crack of the shaddow password algo but this vector could still be used in damaging ways.
If it was a bug in a Google product, you can bet that he would have coordinated his disclosure with a fix.
Like a lot of things, Apple does things quietly and on their own schedule without a lot of hoopla.
Sure many don't do the above, but the OP author is presenting himself as white-hat/legitimate.
And as informed users, we should consider carefully giving our business to vendors who don't go out of their way to encourage private disclosure --- a zero-day on a vendor is a zero-day on all of it's customers.
Although there are various opinions on the best way to disclose bugs, your view of what it means to be "whitehat/legitimate" is not actually consistent with the infosec industry, so please do not misuse the terms to throw judgments at others.
We can easily spin it the other way too after all - one could say that the largest, most profitable company in the world has a moral obligation to compensate those that are protecting their users where they failed to.
For reference: http://www.digitalbond.com/about-us/vulnerability-disclosure... http://erratasec.blogspot.com/2011/09/finally-responsible-di... http://www.securityfocus.com/brief/933 http://trailofbits.com/2009/03/22/no-more-free-bugs/
I entirely agree that Apple should be compensating those that disclosure exploits appropriately - I didn't say otherwise. But if you have a status quo where a vendor won't compensate and you have a zero-day opportunity, I say the appropriate thing is to inform the vendor first anyway (you can always disclosing publicly if you get no response). I fight for the user and all that.
Disclosing it publicly zero-day doesn't make you any money anyway.
Apple, like Microsoft, has the tendency to sweep things under the rug when they feel it is unlikely the situation will become public. The only way to correct this behavior is release what you find to the public and as fast as possible.
[1] - http://en.wikipedia.org/wiki/Responsible_disclosure
TL:DR of above link: "[responsible disclosure] is like full disclosure, with the addition that all stakeholders agree to allow a period of time for the vulnerability to be patched before publishing the details"
I've pasted some other definitions of "responsible disclosure" in a different reply.
I can call myself a shark. That doesn't make it so.
That said, reset or crack any admin's password and you can go to town with sudo.
Like I said, it's not good, but it's not what I would call a "security hole" because there is no escalation of privilege. I like Raymond Chen's take on the topic: http://blogs.msdn.com/b/oldnewthing/archive/2006/05/08/59235...
Doesn't the end of the article suggest that without admin access, you could just reset the password for any admin user, then be able to log in as them? Sounds like priv escalation to me.
Edit: Actually, reading further comments, it seems you can only reset the password of the currently logged in user without reauthentication, so you can only get admin privs if you've already got a console with admin privs. I'm wrong.