Apple has released an update for the macOS High Sierra operating system that fixes a vulnerability that allowed becoming a superuser without entering a password.
“Today <…> the update became available for download, and a little later it will be automatically installed on all macOS High Sierra systems with the latest version (10.13.1),” Apple said in a statement received by Meduza.
The vulnerability became widely known on November 28. As it turned out, in macOS High Sierra, you can activate a superuser with rights to perform any operations if you write the username root in the dialog box requiring a login and password and leave the password field empty.
"We deeply regret this error and apologize to all Mac users, both for the possibility of this vulnerability and for the level of concern it has caused," Apple said in a statement.