Categories: Security News

Apple now Fixed Critical Security bug with macOS High Sierra

A massive bug with MacOS High Sierra was uncovered on Nov 28 which allows anyone can login local admin account with an empty password.

This bug allows anyone to login to the local admin account with the username “root” and no password needed. The security hole came into light after Turkish software developer Lemi Orhan mentioned it on twitter.

You can access it via System Preferences>Users & Groups>Click the lock to make changes. Then use “root” with no password. And try it for several times. The result is unbelievable!

They have notified the bug to Apple on Nov 23, and they also found the bug was already reported in developer forums and even in Apple Developer Forum.

Also Read Imgur Data Breach Exposed 1.7 Million Users Emails and Passwords by Hackers

Yesterday Apple released a security update which fixes the vulnerability of macOS High Sierra 10.13 and macOS High Sierra 10.13.1.

Apple issued the following statement

“Security is a top priority for every Apple product, and regrettably we stumbled with this release of macOS.
When our security engineers became aware of the issue Tuesday afternoon, we immediately began working on an update that closes the security hole. This morning, as of 8:00 a.m., the update is available for download, and starting later today it will be automatically installed on all systems running the latest version (10.13.1) of macOS High Sierra.
We greatly regret this error and we apologize to all Mac users, both for releasing with this vulnerability and for the concern it has caused. Our customers deserve better. We are auditing our development processes to help prevent this from happening again.”

CVE-2017-13872 assigned to this vulnerability, Apple strongly recommends confirming the Security Update.

In Terminal app type what /usr/libexec/opendirectoryd and if installed successfully you can see following project version numbers.

opendirectoryd-483.1.5 on macOS High Sierra 10.13
opendirectoryd-483.20.7 on macOS High Sierra 10.13.1

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting victims…

5 hours ago

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ advanced…

5 hours ago

XSS Vulnerability in Bing.com Let Attackers Send Crafted Malicious Requests

A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to execute…

8 hours ago

Meta Removed 2 Million Account Linked to Malicious Activities

 Meta has announced the removal of over 2 million accounts connected to malicious activities, including…

11 hours ago

Veritas Enterprise Vault Vulnerabilities Lets Attackers Execute Arbitrary Code Remotely

Critical security vulnerability has been identified in Veritas Enterprise Vault, a widely-used archiving and content…

12 hours ago

7-Zip RCE Vulnerability Let Attackers Execute Remote Code

A critical security vulnerability has been disclosed in the popular file archiving tool 7-Zip, allowing…

12 hours ago