Slashdot Mirror

← Back to Stories (view on slashdot.org)

macOS High Sierra's App Store System Preferences Can Be Unlocked With Any Password (macrumors.com)

Posted by msmash on from the state-of-the-art-tech dept.

A bug report submitted on Open Radar this week reveals a security vulnerability in the current version of macOS High Sierra that allows the App Store menu in System Preferences to be unlocked with any password. From a report: MacRumors is able to reproduce the issue on macOS High Sierra version 10.13.2, the latest public release of the operating system, on an administrator-level account by following these steps: 1. Click on System Preferences. 2. Click on App Store. 3. Click on the padlock icon to lock it if necessary. 4. Click on the padlock icon again. 5. Enter your username and any password. 6. Click Unlock.

As mentioned in the radar, System Preferences does not accept an incorrect password with a non-administrator account. We also weren't able to unlock any other System Preferences menus with an incorrect password. We're unable to reproduce the issue on the third or fourth betas of macOS High Sierra 10.13.3, suggesting Apple has fixed the security vulnerability in the upcoming release. However, the update currently remains in testing.

11 of 58 comments (clear)

  1. So I have to have root level access... by Drakonblayde · · Score: 2, Funny

    in order to exploit this. Yeah, not really seeing the big deal.

    1. Re:So I have to have root level access... by sexconker · · Score: 3, Insightful

      So when you need to execute a command with root privileges, what do you do?

      A) Not execute the command.
      B) Use something functionally equivalent to sudo, making your comment absolutely pointless.
      C) Login as root, like a moron.

    2. Re:So I have to have root level access... by viperidaenz · · Score: 2

      It's not the first time they've fucked up authentication recently, so you can be sure it's not the last.

    3. Re:So I have to have root level access... by omnichad · · Score: 2

      That's not what's on the App Store preference pane. It's whether automatic updates are enabled and how long after a app recent purchase before requiring a password again.

      By default, this whole pane is unlocked and there's not much reason that most people would go in and lock this pane.

    4. Re:So I have to have root level access... by demonlapin · · Score: 2

      He's a social justice warrior for log cabin nazism.

      See, stuff like this is why I still come here, long after the site has ceased to have much relevance. The trolls are a bit one-note, but they do still have some style.

  2. Scary because... by 110010001000 · · Score: 4, Insightful

    ...there seems to be a different auth code path for different padlock unlock/lock actions. Oh brother. So the bug isn't a big deal, but the symptom is troubling.

  3. Re:Meh. by Anonymous Coward · · Score: 2, Interesting

    Yeah right.

    Someone’s never been to a computer security conference...

  4. Re:Admin? by fireman+sam · · Score: 2

    This issue could be that you (the rightful admin level user) walks away from your computer to get another coffee and forget to lock it. While you're brewing, Mr Evil enters the scene and can unlock the App Store preferences panel without knowing your password.

    Now I had a look at what is in this panel, there's not much that can be changed in there. The most "harmful" setting may be to save the store password for 15 minutes for purchasing apps.

    Some other truly evil things that can be done in there is to change the checking of updates (Ooohhhh) - perhaps setting the "Automatically download apps purchased on other Macs" could be considered a DOS attack as it wouldn't take long to fill up the internal SSD with crap that you had downloaded over the years.

    Anyway, it is bad that they have a password box that doesn't give a shit about what password you entered, but in this case not much damage can be done.

    --
    it is only after a long journey that you know the strength of the horse.
  5. This is getting ridiculous by joh · · Score: 4, Interesting

    OK, this has somewhat limited potential, but still... what are they doing at Apple? Such things just should not happen. It's almost as if they're developing macOS as a hobby project, and there are hobby projects that do not have such glaring bugs.

    1. Re:This is getting ridiculous by bill_mcgonigle · · Score: 2

      MacOS is being kept on life support only until an iPhone can reasonably replace one with a wireless KVM. "Mac Mode" has been Steve's dream for more than a decade.

      --
      My God, it's Full of Source!
      OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
  6. Re:What's next.... by F.Ultra · · Score: 2

    Just wait for Amazon to patent the "one click login"