topic Re: Apple root password privilege escalation bug in Industry News

Apple root password privilege escalation bug

Early_Adopter — Wed, 29 Nov 2017 04:28:39 GMT

This is catastrophic in terms of the privilege escalation threat/impact to Apple endpoints running High Sierra.

It does have a patch coming, and there is s work round(set root password - highly recommended).

More details alvailble here:

http://www.theregister.co.uk/2017/11/28/root_access_bypass_macos_high_sierra/

Re: Apple root password privilege escalation bug

Badfilemagic — Wed, 29 Nov 2017 12:54:03 GMT

Combined with the keychain password leakage vuln (https://m.slashdot.org/story/331681) that was discovered on release day, it just makes me remember to take most of their posturing about security with a grain of salt. No system is secure, they all just exist at varying levels of insecurity.

Re: Apple root password privilege escalation bug

kpinkham — Wed, 29 Nov 2017 22:34:08 GMT

Looks like the original link is broken or was changed, thank you for sharing.

https://www.theregister.co.uk/2017/11/29/apple_macos_high_sierra_root_bug_patch/

Re: Apple root password privilege escalation bug

kpinkham — Thu, 30 Nov 2017 14:30:15 GMT

Something strange is going on with this patch. I applied it yesterday after reading this post (thanks again) and this morning it installed again.

Re: Apple root password privilege escalation bug

Early_Adopter — Thu, 30 Nov 2017 14:55:51 GMT

Yes thank you. One wonders if the 'root_access_bypass_macos_high_sierra' but of the URL sounded too much like a useful feature?