Apple Issuing macOS High Sierra Patch Today for Major Security Bypass Flaw -- Redmondmag.com

Apple Issuing macOS High Sierra Patch Today for Major Security Bypass Flaw

By Kurt Mackie
11/29/2017

Apple is issuing a patch today for macOS High Sierra users that fixes a major password-bypass flaw in that operating system.

The flaw lets anyone access a system with superuser privileges by using the user name "root" and a blank password. Apple is releasing Security Update 2017-001, which is designed to fix a logic error in the credentials validation process, according to a Nov. 29 Apple support article. The fix is only for macOS High Sierra 10.13.1 users. Older macOS High Sierra versions aren't affected, according to Apple.

The notion that the patch is being pushed out today comes from this TechCrunch article. It included a statement from Apple that the company became aware of the issue on Tuesday of this week and is releasing a patch as of 8:00 a.m. today. The patch will be "automatically installed on all systems running the latest version (10.13.1) of macOS High Sierra," Apple's statement promised.

The flaw was made known on Tuesday Nov. 28 by Lemi Orhan Ergin, founder of Software Craftsmanship Turkey in a Twitter post. He illustrated the ease of access with this screenshot:

**[Click on image for larger view.]** Screenshot showing credentials bypass on unpatched macOS High Sierra 10.13.1. Source: Twitter post by Lemi Orhan Ergin.

However, Ergin later explained in this article that the flaw had been disclosed earlier on Nov. 13 by someone else in the Apple Developer Forum. The staff at Software Craftsmanship Turkey also had informed Apple about the flaw on Nov. 23. Apple's reaction seemed to take place following Ergin's Twitter post on Tuesday, though. Ergin explained that he isn't a security researcher. Instead, his job is to help developers create well-crafted code.

Apple's macOS High Sierra 10.13.1 flaw apparently was conceived as some kind of feature for administrators. Apple's workaround, published in this support article yesterday, had described a temporary fix for the issue by assigning a password for the "root" user. The root user approach seems to be designed to create a "superuser" so that network administrators can access "more areas of the system." However, it seems that unpatched MacOS High Sierra 10.13.1 users right now are subject to anyone having such access.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

Multi-Tenant Organization Hooks Released for Microsoft 365

Microsoft Entra ID's new multi-tenant organization capabilities have reached general availability (GA).
Real-World Ransomware Recovery

Here's how I was (mostly) successful in recovering a family PC infected with malware.
Microsoft Launches Small AI Models Family Phi-3

Recognizing that bigger isn't always better, Microsoft has released its smallest open AI models to date, Phi-3.
Microsoft and OpenAI Continue Global AI Expansions

Microsoft and OpenAI each continued their global expansion this month, with the announcements of new infrastructure investments and service rollouts in new regions, like Asia and the Middle East.
Cisco Warns of Brute Force Attacks Targeting VPNs and Firewalls

Cisco has revealed that a global increase in brute force attacks targeting Virtual Private Networks (VPNs) and other devices is currently taking place.