New macOS Security Bug Unlocks App Store With Any Password

MacBooks and iMac

It doesn't look as though any other password protected settings can be accessed with an incorrect password, and luckily none of the settings in the App Store preferences pane are too sensitive, meaning that it's a lot less serious than the bug from November.

The bug, first reported on community reported bug service OpenRadar, allows an already logged in user with administrative powers to make changes to account preferences in the App Store to be modified without requiring the user enter a password for verification purposes.

While those settings leave limited options for malicious activity, a threat actor could set up additional attacks by preventing the machine from automatically downloading and installing necessary updates, including those that patch security flaws.

Apple has yet another password bug in macOS High Sierra.

Assuming the attacker would be able to gain such access, they would still only be able to change the user's preferences in the App Store. A local admin can enter their username and any password in the App Store section of System Preferences to unlock the menu.

MacOS 10.13 High Sierra Update: Security Bug Allows Settings Changes Without Password
macOS Bug Lets Local Admin Unlock App Store System Prefs With Any Password

With I Am Root still fresh in the memories of users and the recent hoopla over Meltdown and Spectre not yet died-down, this comes at a particularly unwelcome time. Click unlock, and there you have it.

A year ago some of you might recall that Apple's macOS High Sierra had a security flaw/bug which allowed users to gain admin access without the need for a password.

The discovery no doubt brings back memories of the infamous bug that allowed anyone with root access to a device to log in with the least of a hindrance. Fortunately, Apple has confirmed that macOS High Sierra 10.13.3-which is in beta now-corrects the issue (via Macworld).

High Sierra (10.13.2) appears to be the only vulnerable version of the OS at present; the vulnerability doesn't appear on MacOS 10.12.6 or earlier.

The bug report also highlights yet another embarrassing password-related bug for Apple. Our customers deserve better.

Dominion Energy Pays $7.9B For Utility Co. SCANA
This is to offset payments customers have made towards costs incurred by SCE&G over the VC Summer nuclear plant in SC . Public service commissions in South Carolina, North Carolina, and Georgia must also review and approve the merger.

The road to autonomy now has a carpool lane: CES 2018 wrap-up
Power outage causes attendees to evacuate Central Hall at CES in Las Vegas on Wednesday, Jan. 10th, 2018. In a hilarious twist, the event lost power for nearly two hours, leading to some areas getting closed.

Norv Turner finalizing deal to be Panthers' offensive coordinator
Barring a snag, a formal announcement is expected over the next couple of days. Newton has thrown 30 interceptions and 41 touchdowns in the past two years.

Related News:



Most liked

Alexander Downer: the gaffe-prone conservative and unlikely anti-Trump hero
According to the SMH report , Mr Downer relayed the fact of the conversation with Papadopoulos in a diplomatic cable to Canberra. Mr Papadopoulos said such contacts occurred before he joined Mr Trump's campaign, but that later turned out to be false.

Zuma To Set Up Inquiry Into 'State Capture'
Mr Zuma's announcement came ahead of today's meeting of the top leadership body of the governing African National Congress (ANC). The claim incensed safe-sex campaigners - not least because Zuma was head of the country's national AIDS council at the time.

December retail inflation soars 5.21 pct
Prices for US Treasuries fell, with the yield on the interest-rate sensitive two-year note rising to the highest since 2008. Households also paid more for new motor vehicles, which rose 0.6% in price last month, the biggest gain since January.

Hundreds help welcome Ryland Ward home from hospital
Ryland's stepmother, Joann Lookingbill Ward, was among the dead as well as her daughters Brooke, 5, and Emily, 7. Today, the final victim recovering in the hospital, a six-year-old boy, got to ride home in style.

Bell threatens to sit or retire if franchise tagged again
I just want to be valued where I'm at", per ESPN . "I don't necessarily care about the money aspect of it", explains Bell. But he doesn't have any intention of staying if he doesn't get the kind of long-term deal he feels he deserves.

Chris Paul, James Harden among leaders in latest All-Star voting returns
As the second half of the National Basketball Association season tips off, we predict the Eastern Conference playoff picture. But I just feel Joel Embiid's greatness on the court and on social media around the country will help him land that spot.

Everton boss Allardyce confirms talks for Arsenal attacker Walcott
Everton are in talks with Arsenal to sign forward Theo Walcott , the club's manager Sam Allardyce has confirmed. Theo Walcott has been a bit-part figure at Arsenal this season, spending much of his time on the bench.

Netflix Releases New Trailer For Upcoming "Altered Carbon" Series
Enter Miguel Sapochnik, director of Game of Thrones' best ever episode - "Hardhome" - and enter Richard Morgan's Philip K. While police ruled it a suicide, Bancroft is convinced he was murdered and wants Kovacs to find out the truth.

Cruise AV: GM Removes the Steering Wheel
This comes as little surprise given the company has been utilizing specialized Bolt EV's for autonomous testing for some time now. The company declined to identify the first states in which it plans to launch the vehicle or say when it would begin testing.

Germany's Angela Merkel embarks on new talks to type authorities
And if they back full talks, entering government hinges on a second poll , of all SPD members, on any final coalition deal. Mrs Merkel admitted there had been hard "blockages" during the Berlin talks.

Kneeling Protest Planned Ahead Of Vikings-Saints Playoff Game
Another Super Bowl would burnish his legacy and gain him entry into the rare club of multiple-Super Bowl-winning quarterbacks. We have a third down meeting, a red zone and then we talk a lot about third downs in the red zone.

Steelers set for "déjà vu" playoff performance against Jacksonville
Bell finished the 2017 season third in rushing yards with 1,291 while scoring nine touchdowns on the ground. Blake Bortles did not have a real strong game in the win over the Chiefs with his passing game.

Armed robbery at jewelry store in the Ritz hotel in Paris
A French police source said: "I can confirm that all the stolen jewels were found in the bag recovered by police officers". Three suspects are in police custody and will continue to be held for an extended 24 hours, a judicial source told CNN .

Infosys profit beats expectations on tax benefits
Net profit was up 37.7 percent at Rs 5,129 crore due to lower tax expenses (see chart). Dollar revenue growth at 1 percent and constant currency revenue at 0.8 percent QoQ.

Girl raped and murdered in Pakistan had been held captive
Two protesters were killed on Wednesday after an angry crowd tried to storm the local police headquarters, and police opened fire. Following a meeting with Zainab's father Anees, Punjab chief minister Shahbaz Sharif sacked Kasur's police chief for negligence.