Is my system vulnerable to Apple's new password-in-clear-text bug?

Solution 1:

As stated in the article linked in the question:

Anyone who used FileVault encryption on their Mac prior to Lion, upgraded to Lion, but kept the folders encrypted using the legacy version of FileVault is vulnerable. FileVault 2 (whole disk encryption) is unaffected.

The password shows up in /var/log/secure.log. To look for it, log in as an Administrator, open Terminal.app and run

sudo grep -i passwordAsUTF8String /var/log/secure.log

Have a look at the result (if any) to see whether passwords appear in plain text.

For additional information see

• Apple update to OS X Lion exposes encryption passwords
• Apple Legacy Filevault Hole