Apple Issuing macOS High Sierra Patch Today for Major Security Bypass Flaw -- Redmondmag.com

Apple Issuing macOS High Sierra Patch Today for Major Security Bypass Flaw

By Kurt Mackie
11/29/2017

Apple is issuing a patch today for macOS High Sierra users that fixes a major password-bypass flaw in that operating system.

The flaw lets anyone access a system with superuser privileges by using the user name "root" and a blank password. Apple is releasing Security Update 2017-001, which is designed to fix a logic error in the credentials validation process, according to a Nov. 29 Apple support article. The fix is only for macOS High Sierra 10.13.1 users. Older macOS High Sierra versions aren't affected, according to Apple.

The notion that the patch is being pushed out today comes from this TechCrunch article. It included a statement from Apple that the company became aware of the issue on Tuesday of this week and is releasing a patch as of 8:00 a.m. today. The patch will be "automatically installed on all systems running the latest version (10.13.1) of macOS High Sierra," Apple's statement promised.

The flaw was made known on Tuesday Nov. 28 by Lemi Orhan Ergin, founder of Software Craftsmanship Turkey in a Twitter post. He illustrated the ease of access with this screenshot:

**[Click on image for larger view.]** Screenshot showing credentials bypass on unpatched macOS High Sierra 10.13.1. Source: Twitter post by Lemi Orhan Ergin.

However, Ergin later explained in this article that the flaw had been disclosed earlier on Nov. 13 by someone else in the Apple Developer Forum. The staff at Software Craftsmanship Turkey also had informed Apple about the flaw on Nov. 23. Apple's reaction seemed to take place following Ergin's Twitter post on Tuesday, though. Ergin explained that he isn't a security researcher. Instead, his job is to help developers create well-crafted code.

Apple's macOS High Sierra 10.13.1 flaw apparently was conceived as some kind of feature for administrators. Apple's workaround, published in this support article yesterday, had described a temporary fix for the issue by assigning a password for the "root" user. The root user approach seems to be designed to create a "superuser" so that network administrators can access "more areas of the system." However, it seems that unpatched MacOS High Sierra 10.13.1 users right now are subject to anyone having such access.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

Using Configuration Files to Control PowerShell Scripts, Part 2: Building Blocks

Learn how to use PowerShell's GUI capabilities to dynamically create configuration files that enhance script flexibility and usability.
U.S. House Leaders Unveil Bipartisan Strategy for AI Governance and Innovation

On Tuesday, U.S. House Speaker Mike Johnson and Democratic Leader Hakeem Jeffries received the final report from the bipartisan House Task Force on Artificial Intelligence, which outlines essential principles and recommendations to bolster American leadership in AI.
Using Configuration Files to Control PowerShell Scripts, Part 1: The Basics

Learn how to use JSON configuration files to make PowerShell scripts more dynamic, flexible and user-friendly.
Exchange Online Receiving Enhanced Message Trace

Microsoft has announced the public preview of its enhanced Message Trace feature in the Exchange admin center (EAC) for Exchange Online.
Major Microsoft Multifactor Authentication Vulnerability Revealed

A vulnerability in Microsoft’s multifactor authentication (MFA) system has been uncovered by cybersecurity firm Oasis Security, allowing attackers to bypass security measures and access sensitive data across services including Outlook, OneDrive, Teams and Azure.