Apple today released Security Update 2017-001 to fix a serious vulnerability that enables access to the root superuser account with a blank password on any Mac running macOS High Sierra version 10.13.1.
The critical bug, which gained attention after it was tweeted by developer Lemi Ergin yesterday, lets anyone gain administrator privileges by simply entering the username "root" and a blank password in System Preferences > Users & Groups.
The security update is rolling out on the Mac App Store now, and it should be installed by all users running macOS High Sierra as soon as possible. Regardless, starting later today, Apple said the security update will be automatically installed on all Macs running macOS High Sierra 10.13.1.
Apple has since apologized for the vulnerability in a statement issued to MacRumors:
Security is a top priority for every Apple product, and regrettably we stumbled with this release of macOS.
When our security engineers became aware of the issue Tuesday afternoon, we immediately began working on an update that closes the security hole. This morning, as of 8 a.m., the update is available for download, and starting later today it will be automatically installed on all systems running the latest version (10.13.1) of macOS High Sierra.
We greatly regret this error and we apologize to all Mac users, both for releasing with this vulnerability and for the concern it has caused. Our customers deserve better. We are auditing our development processes to help prevent this from happening again.
The vulnerability does not affect macOS Sierra or any other previous version of the operating system.
Top Stories
Leaker Claims New 13-inch MacBook Pro Coming as Soon as Next Month
iOS 14 Could Offer Home Screen Widgets, Wallpaper Customizations
Top Stories: Apple Leaks iPhone SE and AirTags, Apple Buys Dark Sky, and More
Apple Music Was Second Biggest Global Music Streaming Service in 2019
More References to Apple's Upcoming Low-Cost iPhone Appear Online
The New York Times, IFTTT, Medium, and Other Apps Adopt Sign in With Apple Ahead of June 30 Deadline
Apple Offers Employees Deep Discounts on HomePod, Beats Headphones and More
New Low-Cost 'iPhone SE' Could Launch as Soon as Tomorrow
EPIX Available for Free Through Apple TV Channels Until May 2, No Subscription Required
Top Rated Comments
(View all)I wish Apple did a better job testing their releases. We used to enjoy such high quality when it came to software updates and releases.
That was quick
And it was utterly necessary that it be just that.How embarrassing...
You ever heard of Windows? Perhaps you should read up on that OS if you haven't.I wish Apple did a better job testing their releases. We used to enjoy such high quality when it came to software updates and releases.
Also, give me a break. Nobody finds everything, not even "Apple". Patched quickly and painlessly. Move along.
You ever heard of Windows? Perhaps you should read up on that OS if you haven't.
Three... count 'em... THREE... critical and ridiculous security issues with Mac OS High Sierra within as many months. This one, the Disk utility one, and the keychain one. And that's just the security issues...Also, give me a break. Nobody finds everything, not even "Apple". Patched quickly and painlessly. Move along.
There's no excuse for it. Saying "well, microsoft is just as bad" just means that Apple is stooping to Microsoft's level... but I'd actually venture to say that Apple is starting to get worse than Microsoft when it comes to Mac OS vs Windows.