Apple Issuing macOS High Sierra Patch Today for Major Security Bypass Flaw -- Redmondmag.com

Apple Issuing macOS High Sierra Patch Today for Major Security Bypass Flaw

By Kurt Mackie
11/29/2017

Apple is issuing a patch today for macOS High Sierra users that fixes a major password-bypass flaw in that operating system.

The flaw lets anyone access a system with superuser privileges by using the user name "root" and a blank password. Apple is releasing Security Update 2017-001, which is designed to fix a logic error in the credentials validation process, according to a Nov. 29 Apple support article. The fix is only for macOS High Sierra 10.13.1 users. Older macOS High Sierra versions aren't affected, according to Apple.

The notion that the patch is being pushed out today comes from this TechCrunch article. It included a statement from Apple that the company became aware of the issue on Tuesday of this week and is releasing a patch as of 8:00 a.m. today. The patch will be "automatically installed on all systems running the latest version (10.13.1) of macOS High Sierra," Apple's statement promised.

The flaw was made known on Tuesday Nov. 28 by Lemi Orhan Ergin, founder of Software Craftsmanship Turkey in a Twitter post. He illustrated the ease of access with this screenshot:

**[Click on image for larger view.]** Screenshot showing credentials bypass on unpatched macOS High Sierra 10.13.1. Source: Twitter post by Lemi Orhan Ergin.

However, Ergin later explained in this article that the flaw had been disclosed earlier on Nov. 13 by someone else in the Apple Developer Forum. The staff at Software Craftsmanship Turkey also had informed Apple about the flaw on Nov. 23. Apple's reaction seemed to take place following Ergin's Twitter post on Tuesday, though. Ergin explained that he isn't a security researcher. Instead, his job is to help developers create well-crafted code.

Apple's macOS High Sierra 10.13.1 flaw apparently was conceived as some kind of feature for administrators. Apple's workaround, published in this support article yesterday, had described a temporary fix for the issue by assigning a password for the "root" user. The root user approach seems to be designed to create a "superuser" so that network administrators can access "more areas of the system." However, it seems that unpatched MacOS High Sierra 10.13.1 users right now are subject to anyone having such access.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

Choosing the Right SSID for Your Network

Attracting attention, whether through a default or funny Wi-Fi name, could lead to a security issue.
Microsoft Outlines Latest Security Efforts at Ignite

In the wake of last year's CrowdStrike incident, Microsoft has worked to publicly rehabilitate its security image through new initiatives and public commitments to improve. That push continued this week at Ignite, where Microsoft announced a handful of new security tools and updates.
Nadella on Copilot: 'Major Platform Shifts Are in the Air'

As should be no surprise, Copilot took center stage during Microsoft CEO Satya Nadella's keynote speech to open Microsoft Ignite 2024.
Azure AI Foundry Revealed at Microsoft Ignite

Microsoft is consolidating its Azure generative AI tools into a unified platform named Azure AI Foundry.
Microsoft Bolsters Fabric at Ignite

While Fabric has improved in the year since its release, there are still some glaring issues with the platform.