Apple Issuing macOS High Sierra Patch Today for Major Security Bypass Flaw
Apple is issuing a patch today for macOS High Sierra users that fixes a major password-bypass flaw in that operating system.
The flaw lets anyone access a system with superuser privileges by using the user name "root" and a blank password. Apple is releasing Security Update 2017-001, which is designed to fix a logic error in the credentials validation process, according to a Nov. 29 Apple support article. The fix is only for macOS High Sierra 10.13.1 users. Older macOS High Sierra versions aren't affected, according to Apple.
The notion that the patch is being pushed out today comes from this TechCrunch article. It included a statement from Apple that the company became aware of the issue on Tuesday of this week and is releasing a patch as of 8:00 a.m. today. The patch will be "automatically installed on all systems running the latest version (10.13.1) of macOS High Sierra," Apple's statement promised.
The flaw was made known on Tuesday Nov. 28 by Lemi Orhan Ergin, founder of Software Craftsmanship Turkey in a Twitter post. He illustrated the ease of access with this screenshot:
However, Ergin later explained in this article that the flaw had been disclosed earlier on Nov. 13 by someone else in the Apple Developer Forum. The staff at Software Craftsmanship Turkey also had informed Apple about the flaw on Nov. 23. Apple's reaction seemed to take place following Ergin's Twitter post on Tuesday, though. Ergin explained that he isn't a security researcher. Instead, his job is to help developers create well-crafted code.
Apple's macOS High Sierra 10.13.1 flaw apparently was conceived as some kind of feature for administrators. Apple's workaround, published in this support article yesterday, had described a temporary fix for the issue by assigning a password for the "root" user. The root user approach seems to be designed to create a "superuser" so that network administrators can access "more areas of the system." However, it seems that unpatched MacOS High Sierra 10.13.1 users right now are subject to anyone having such access.
Kurt Mackie is senior news producer for the 1105 Enterprise Computing Group.