A massive bug with MacOS High Sierra was uncovered on Nov 28 which allows anyone can login local admin account with an empty password.
This bug allows anyone to login to the local admin account with the username “root” and no password needed. The security hole came into light after Turkish software developer Lemi Orhan mentioned it on twitter.
You can access it via System Preferences>Users & Groups>Click the lock to make changes. Then use “root” with no password. And try it for several times. The result is unbelievable!
You can access it via System Preferences>Users & Groups>Click the lock to make changes. Then use "root" with no password. And try it for several times. Result is unbelievable! pic.twitter.com/m11qrEvECs
— Lemi Orhan Ergin (@lemiorhan) November 28, 2017
They have notified the bug to Apple on Nov 23, and they also found the bug was already reported in developer forums and even in Apple Developer Forum.
Also Read Imgur Data Breach Exposed 1.7 Million Users Emails and Passwords by Hackers
Yesterday Apple released a security update which fixes the vulnerability of macOS High Sierra 10.13 and macOS High Sierra 10.13.1.
Apple issued the following statement
“Security is a top priority for every Apple product, and regrettably we stumbled with this release of macOS.
When our security engineers became aware of the issue Tuesday afternoon, we immediately began working on an update that closes the security hole. This morning, as of 8:00 a.m., the update is available for download, and starting later today it will be automatically installed on all systems running the latest version (10.13.1) of macOS High Sierra.
We greatly regret this error and we apologize to all Mac users, both for releasing with this vulnerability and for the concern it has caused. Our customers deserve better. We are auditing our development processes to help prevent this from happening again.”
Now Fixed… https://t.co/QRWE6mKirt
— GBHackers on Security (@gbhackers_news) November 30, 2017
CVE-2017-13872 assigned to this vulnerability, Apple strongly recommends confirming the Security Update.
In Terminal app type what /usr/libexec/opendirectoryd and if installed successfully you can see following project version numbers.
opendirectoryd-483.1.5 on macOS High Sierra 10.13
opendirectoryd-483.20.7 on macOS High Sierra 10.13.1
