search menu icon-carat-right cmu-wordmark

CERT Coordination Center


Apple MacOS High Sierra disabled account authentication bypass

Vulnerability Note VU#113765

Original Release Date: 2017-11-29 | Last Revised: 2017-11-30

Overview

Apple MacOS High Sierra fails to properly require authentication for disabled accounts, such as root account, which can allow an authenticated user to obtain root privileges.

Description

Apple MacOS High Sierra (10.13) contains a flaw in how it authenticates disabled accounts. When a privileged action prompts the user for administrative credentials, the user can simply enter the user of "root" with an empty password. The first attempt appears to fail, but in actuality, this action causes MacOS High Sierra to enable the ability to log in as root using the credentials specified. A second attempt to authenticate using the same credentials successfully takes the action with root administrative privileges. Once this vulnerability has been triggered by an authenticated user (either locally, or via remote access such as SSH), the root account will be available to use as a viable authentication mechanism to the system.

It is important to note that simply confirming the vulnerability on a system will have the side effect of enabling the root account for use in authenticating to the system.

Impact

A local or remote user of a MacOS High Sierra system can obtain root privileges without requiring credentials. Any system that has the root account enabled (e.g. via testing for this vulnerability) may also expose the root account for use with remote administrative capabilities, such as the built-in "Screen Sharing" or "Remote Management" capabilities

Solution

Apply an update

This issue is addressed in Security Update 2017-001. Please also consider the following workaround if you are unable to install the update:

Set the root password

    1. As a user with administrative privileges, launch Terminal
    2. Type sudo passwd -u root
    3. Enter a strong password

    For an alternative GUI method to setting the root password, please see Apple support article HT204012.

    Note: It is important to not disable the root account after setting a password. If the root account is disabled after setting a password, this action will revert the system back to the vulnerable state.

    Vendor Information

    113765
    Expand all

    Apple

    Notified:  November 29, 2017 Updated:  November 29, 2017

    Status

      Affected

    Vendor Statement

    No statement is currently available from the vendor regarding this vulnerability.

    Vendor Information

    We are not aware of further vendor information regarding this vulnerability.

    Vendor References

    https://support.apple.com/en-us/HT208315

    Addendum

    There are no additional comments at this time.

    If you have feedback, comments, or additional information about this vulnerability, please send us email.


    CVSS Metrics

    Group Score Vector
    Base 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C
    Temporal 6.2 E:POC/RL:W/RC:C
    Environmental 4.6 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

    References

    Credit

    This vulnerability was publicly disclosed by chethan177.

    This document was written by Will Dormann.

    Other Information

    CVE IDs: CVE-2017-13872
    Date Public: 2017-11-13
    Date First Published: 2017-11-29
    Date Last Updated: 2017-11-30 02:43 UTC
    Document Revision: 41

    Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.