Is my system vulnerable to Apple's new password-in-clear-text bug? With the latest Lion security update, Mac OS X 10.7.3, Apple has accidentally turned on a debug log file outside of the encrypted area that stores the user’s password in clear text.


How can I determine whether my system if affected by this issue? If so, can I work around it, and also determine which users’ passwords have been exposed?
As stated in the article linked in the question:


  Anyone who used FileVault encryption on their Mac prior to Lion, upgraded to Lion, but kept the folders encrypted using the legacy version of FileVault is vulnerable. FileVault 2 (whole disk encryption) is unaffected.


The password shows up in /var/log/secure.log. To look for it, log in as an Administrator, open Terminal.app and run

sudo grep -i passwordAsUTF8String /var/log/secure.log


Have a look at the result (if any) to see whether passwords appear in plain text.



For additional information see


Apple update to OS X Lion exposes encryption passwords
Apple Legacy Filevault Hole