Apple Issuing macOS High Sierra Patch Today for Major Security Bypass Flaw

Apple is issuing a patch today for macOS High Sierra users that fixes a major password-bypass flaw in that operating system.

The flaw lets anyone access a system with superuser privileges by using the user name "root" and a blank password. Apple is releasing Security Update 2017-001, which is designed to fix a logic error in the credentials validation process, according to a Nov. 29 Apple support article. The fix is only for macOS High Sierra 10.13.1 users. Older macOS High Sierra versions aren't affected, according to Apple.

The notion that the patch is being pushed out today comes from this TechCrunch article. It included a statement from Apple that the company became aware of the issue on Tuesday of this week and is releasing a patch as of 8:00 a.m. today. The patch will be "automatically installed on all systems running the latest version (10.13.1) of macOS High Sierra," Apple's statement promised.

The flaw was made known on Tuesday Nov. 28 by Lemi Orhan Ergin, founder of Software Craftsmanship Turkey in a Twitter post. He illustrated the ease of access with this screenshot:

[Click on image for larger view.] Screenshot showing credentials bypass on unpatched macOS High Sierra 10.13.1. Source: Twitter post by Lemi Orhan Ergin.

However, Ergin later explained in this article that the flaw had been disclosed earlier on Nov. 13 by someone else in the Apple Developer Forum. The staff at Software Craftsmanship Turkey also had informed Apple about the flaw on Nov. 23. Apple's reaction seemed to take place following Ergin's Twitter post on Tuesday, though. Ergin explained that he isn't a security researcher. Instead, his job is to help developers create well-crafted code.

Apple's macOS High Sierra 10.13.1 flaw apparently was conceived as some kind of feature for administrators. Apple's workaround, published in this support article yesterday, had described a temporary fix for the issue by assigning a password for the "root" user. The root user approach seems to be designed to create a "superuser" so that network administrators can access "more areas of the system." However, it seems that unpatched MacOS High Sierra 10.13.1 users right now are subject to anyone having such access.

About the Author

Kurt Mackie is senior news producer for the 1105 Enterprise Computing Group.


  • How To Remove the Windows 10 Action Center

    Microsoft meant well with Windows 10's Action Center, but the constant pop-up notifications are often more annoying than helpful. Here's how to get rid of them.

  • Google IDs on Azure Active Directory B2B Service Now at 'General Availability'

    Microsoft announced on Wednesday that users of the Google identity and access service can use their personal log-in IDs with the Azure Active Directory B2B service to access resources as "guests."

  • Top 4 Overlooked Features of a Data Backup Strategy

    When it comes to implementing an airtight backup-and-recovery plan, these are the four must-have features that many enterprises nevertheless tend to forget.

  • Microsoft Bolsters Kubernetes with Azure Confidential Computing

    Microsoft on Tuesday announced various developments concerning the use of Kubernetes, an open source container orchestration solution fostered by Google.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.