{"id":43026,"date":"2017-11-29T10:04:53","date_gmt":"2017-11-29T16:04:53","guid":{"rendered":"https:\/\/eshop.macsales.com\/blog\/?p=43026"},"modified":"2017-11-29T15:20:16","modified_gmt":"2017-11-29T21:20:16","slug":"how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug","status":"publish","type":"post","link":"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/","title":{"rendered":"How to Fix the High Sierra ‘Full Admin Access Without Password’ Bug [Updated]"},"content":{"rendered":"

\"\"[Update 11\/29:<\/strong> Apple Releases macOS High Sierra Security Update to Fix Root Password Vulnerability, according to MacRumors<\/a>]<\/strong><\/p>\n

You may have heard rumblings about an incredibly bad bug in macOS High Sierra<\/a> that allows anyone to walk up to a Mac and log in as a root superuser without needing a password. Now the root superuser has ultimate control of any UNIX-based machine, and that’s the case with this bug; as root, you can pretty much “have your way” with a Mac. This post is to show you how the bug works and how to quickly enable a fix until Apple is able to send out a macOS High Sierra update.<\/p>\n

The bug was discovered by developer Lemi Ergin<\/a>, who found that anyone could sit down at a Mac and get superuser just by using the username “root” and a blank password. It works when trying to access an administrator account on an unlocked Mac, but even worse, it lets anyone log into a locked Mac using “root” and the blank password.<\/p>\n

Want to try this on your own Mac? Here’s how (and this works from any Mac account, whether with admin rights or as a guest):<\/p>\n

1)<\/strong> Launch System Preferences<\/p>\n

2)<\/strong> Click on Users & Groups<\/p>\n

3)<\/strong> Click the lock icon in the lower left corner to provide access for making changes to a user account<\/p>\n

4)<\/strong> Type “root” as the User Name<\/p>\n

5)<\/strong> Move the cursor to the Password field, click on it, but don’t type a password into the blank field<\/p>\n

6)<\/strong> Click the “Unlock” button. The Mac should now give you full access to add a new administrator account, delete an account, and so on…<\/p>\n

\"With
(With this bug, logging in as user “root” with a blank password provides full access to a Mac.)<\/strong><\/figcaption><\/figure>\n

This also works at a Mac login screen, where you can click “Other” to sign in as someone other than the usual user of the Mac, then enter “root” as the user name with no password. That root user can see everything on the Mac, delete files, and wreak havoc…<\/p>\n

Apple has responded to the revelation about the bug with a note that says:<\/p>\n

“We are working on a software update to address this issue. In the meantime, setting a root password prevents unauthorized access to your Mac. To enable the Root User and set a password, please follow the instructions here: https:\/\/support.apple.com\/en-us\/HT204012<\/a><\/strong>. If a Root User is already enabled, to ensure a blank password is not set, please follow the instructions from the ‘Change the root password’ section.”<\/p><\/blockquote>\n

This might not be an issue if you’re the only person with access to your Mac, but if you’re in an environment where someone has unfettered access to your Mac you should set a root account with a password.<\/p>\n

Rather than repeat what is said on the Apple support page referenced in the quote above, we suggest that you head to that web page immediately and follow the instructions to enable the root user on your Mac. Note that once Apple has resolved the issue with a patch, you should disable the root user.<\/p>\n","protected":false},"excerpt":{"rendered":"

[Update 11\/29: Apple Releases macOS High Sierra Security Update to Fix Root Password Vulnerability, according to MacRumors] You may have heard rumblings about an incredibly bad bug in macOS High Sierra that allows anyone to walk up to a Mac and log in as a root superuser without needing a password. Now the root superuser has […]<\/p>\n","protected":false},"author":81,"featured_media":40335,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"spay_email":"","footnotes":""},"categories":[4],"class_list":["post-43026","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tech-tips"],"yoast_head":"\nHow to Fix the macOS High Sierra "Full Admin Access Without Password" Bug<\/title>\n<meta name=\"description\" content=\"This post is to show you how the bug works and how to quickly enable a fix until Apple is able to send out a macOS High Sierra update\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Fix the High Sierra 'Full Admin Access Without Password' Bug [Updated]\" \/>\n<meta property=\"og:description\" content=\"This post is to show you how the bug works and how to quickly enable a fix until Apple is able to send out a macOS High Sierra update\" \/>\n<meta property=\"og:url\" content=\"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/\" \/>\n<meta property=\"og:site_name\" content=\"Rocket Yard\" \/>\n<meta property=\"article:author\" content=\"https:\/\/facebook.com\/stevensande\" \/>\n<meta property=\"article:published_time\" content=\"2017-11-29T16:04:53+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2017-11-29T21:20:16+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/eshop.macsales.com\/blog\/wp-content\/uploads\/2017\/03\/Apple-Logo-black-284x261.png\" \/>\n\t<meta property=\"og:image:width\" content=\"284\" \/>\n\t<meta property=\"og:image:height\" content=\"261\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Steve Sande\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Steve Sande\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/\"},\"author\":{\"name\":\"Steve Sande\",\"@id\":\"https:\/\/eshop.macsales.com\/blog\/#\/schema\/person\/1152721d0acb70692858d0f3fcb12e7a\"},\"headline\":\"How to Fix the High Sierra ‘Full Admin Access Without Password’ Bug [Updated]\",\"datePublished\":\"2017-11-29T16:04:53+00:00\",\"dateModified\":\"2017-11-29T21:20:16+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/\"},\"wordCount\":546,\"commentCount\":1,\"publisher\":{\"@id\":\"https:\/\/eshop.macsales.com\/blog\/#organization\"},\"keywords\":[\"bug\",\"macOS High Sierra\",\"root user\",\"Security\"],\"articleSection\":[\"Tech Tips\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/\",\"url\":\"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/\",\"name\":\"How to Fix the macOS High Sierra \\\"Full Admin Access Without Password\\\" Bug\",\"isPartOf\":{\"@id\":\"https:\/\/eshop.macsales.com\/blog\/#website\"},\"datePublished\":\"2017-11-29T16:04:53+00:00\",\"dateModified\":\"2017-11-29T21:20:16+00:00\",\"description\":\"This post is to show you how the bug works and how to quickly enable a fix until Apple is able to send out a macOS High Sierra update\",\"breadcrumb\":{\"@id\":\"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/eshop.macsales.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Fix the High Sierra ‘Full Admin Access Without Password’ Bug [Updated]\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/eshop.macsales.com\/blog\/#website\",\"url\":\"https:\/\/eshop.macsales.com\/blog\/\",\"name\":\"Rocket Yard\",\"description\":\"Your source for expert tips, special deals, commentary, reviews, and the latest tech news.\",\"publisher\":{\"@id\":\"https:\/\/eshop.macsales.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/eshop.macsales.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/eshop.macsales.com\/blog\/#organization\",\"name\":\"OWC\",\"url\":\"https:\/\/eshop.macsales.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/eshop.macsales.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/eshop.macsales.com\/blog\/wp-content\/uploads\/2020\/06\/rocket-yard-logo-round.png\",\"contentUrl\":\"https:\/\/eshop.macsales.com\/blog\/wp-content\/uploads\/2020\/06\/rocket-yard-logo-round.png\",\"width\":1024,\"height\":1024,\"caption\":\"OWC\"},\"image\":{\"@id\":\"https:\/\/eshop.macsales.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/eshop.macsales.com\/blog\/#\/schema\/person\/1152721d0acb70692858d0f3fcb12e7a\",\"name\":\"Steve Sande\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/eshop.macsales.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/1ad8e267ec82e12963d9cfe717c9b8e108e1edbb728f5d91fe50c6e7ecd14b15?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/1ad8e267ec82e12963d9cfe717c9b8e108e1edbb728f5d91fe50c6e7ecd14b15?s=96&d=mm&r=g\",\"caption\":\"Steve Sande\"},\"description\":\"Steve has been writing about Apple products since 1986, starting on a bulletin board system, creating the first of his many Apple-related websites in 1994, joining the staff of The Unofficial Apple Weblog in 2008, and founding Apple World Today in 2015. He\u2019s semi-retired, loves to camp and take photos, and is an FAA-licensed drone pilot.\",\"sameAs\":[\"https:\/\/appleworld.today\",\"https:\/\/facebook.com\/stevensande\",\"https:\/\/www.linkedin.com\/in\/stevensande\/\",\"https:\/\/www.youtube.com\/channel\/UCUnDTuaRnXncKQXfQYVNIJA\/\"],\"url\":\"https:\/\/eshop.macsales.com\/blog\/author\/steve-sande\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"How to Fix the macOS High Sierra \"Full Admin Access Without Password\" Bug","description":"This post is to show you how the bug works and how to quickly enable a fix until Apple is able to send out a macOS High Sierra update","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/","og_locale":"en_US","og_type":"article","og_title":"How to Fix the High Sierra 'Full Admin Access Without Password' Bug [Updated]","og_description":"This post is to show you how the bug works and how to quickly enable a fix until Apple is able to send out a macOS High Sierra update","og_url":"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/","og_site_name":"Rocket Yard","article_author":"https:\/\/facebook.com\/stevensande","article_published_time":"2017-11-29T16:04:53+00:00","article_modified_time":"2017-11-29T21:20:16+00:00","og_image":[{"width":284,"height":261,"url":"https:\/\/eshop.macsales.com\/blog\/wp-content\/uploads\/2017\/03\/Apple-Logo-black-284x261.png","type":"image\/png"}],"author":"Steve Sande","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Steve Sande","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/#article","isPartOf":{"@id":"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/"},"author":{"name":"Steve Sande","@id":"https:\/\/eshop.macsales.com\/blog\/#\/schema\/person\/1152721d0acb70692858d0f3fcb12e7a"},"headline":"How to Fix the High Sierra ‘Full Admin Access Without Password’ Bug [Updated]","datePublished":"2017-11-29T16:04:53+00:00","dateModified":"2017-11-29T21:20:16+00:00","mainEntityOfPage":{"@id":"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/"},"wordCount":546,"commentCount":1,"publisher":{"@id":"https:\/\/eshop.macsales.com\/blog\/#organization"},"keywords":["bug","macOS High Sierra","root user","Security"],"articleSection":["Tech Tips"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/","url":"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/","name":"How to Fix the macOS High Sierra \"Full Admin Access Without Password\" Bug","isPartOf":{"@id":"https:\/\/eshop.macsales.com\/blog\/#website"},"datePublished":"2017-11-29T16:04:53+00:00","dateModified":"2017-11-29T21:20:16+00:00","description":"This post is to show you how the bug works and how to quickly enable a fix until Apple is able to send out a macOS High Sierra update","breadcrumb":{"@id":"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/eshop.macsales.com\/blog\/43026-how-to-fix-the-macos-high-sierra-full-admin-access-without-password-bug\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/eshop.macsales.com\/blog\/"},{"@type":"ListItem","position":2,"name":"How to Fix the High Sierra ‘Full Admin Access Without Password’ Bug [Updated]"}]},{"@type":"WebSite","@id":"https:\/\/eshop.macsales.com\/blog\/#website","url":"https:\/\/eshop.macsales.com\/blog\/","name":"Rocket Yard","description":"Your source for expert tips, special deals, commentary, reviews, and the latest tech news.","publisher":{"@id":"https:\/\/eshop.macsales.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/eshop.macsales.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/eshop.macsales.com\/blog\/#organization","name":"OWC","url":"https:\/\/eshop.macsales.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/eshop.macsales.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/eshop.macsales.com\/blog\/wp-content\/uploads\/2020\/06\/rocket-yard-logo-round.png","contentUrl":"https:\/\/eshop.macsales.com\/blog\/wp-content\/uploads\/2020\/06\/rocket-yard-logo-round.png","width":1024,"height":1024,"caption":"OWC"},"image":{"@id":"https:\/\/eshop.macsales.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/eshop.macsales.com\/blog\/#\/schema\/person\/1152721d0acb70692858d0f3fcb12e7a","name":"Steve Sande","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/eshop.macsales.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/1ad8e267ec82e12963d9cfe717c9b8e108e1edbb728f5d91fe50c6e7ecd14b15?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1ad8e267ec82e12963d9cfe717c9b8e108e1edbb728f5d91fe50c6e7ecd14b15?s=96&d=mm&r=g","caption":"Steve Sande"},"description":"Steve has been writing about Apple products since 1986, starting on a bulletin board system, creating the first of his many Apple-related websites in 1994, joining the staff of The Unofficial Apple Weblog in 2008, and founding Apple World Today in 2015. He\u2019s semi-retired, loves to camp and take photos, and is an FAA-licensed drone pilot.","sameAs":["https:\/\/appleworld.today","https:\/\/facebook.com\/stevensande","https:\/\/www.linkedin.com\/in\/stevensande\/","https:\/\/www.youtube.com\/channel\/UCUnDTuaRnXncKQXfQYVNIJA\/"],"url":"https:\/\/eshop.macsales.com\/blog\/author\/steve-sande\/"}]}},"jetpack_featured_media_url":"https:\/\/eshop.macsales.com\/blog\/wp-content\/uploads\/2017\/03\/Apple-Logo-black-284x261.png","jetpack_shortlink":"https:\/\/wp.me\/pmPaT-bbY","_links":{"self":[{"href":"https:\/\/eshop.macsales.com\/blog\/wp-json\/wp\/v2\/posts\/43026","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/eshop.macsales.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/eshop.macsales.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/eshop.macsales.com\/blog\/wp-json\/wp\/v2\/users\/81"}],"replies":[{"embeddable":true,"href":"https:\/\/eshop.macsales.com\/blog\/wp-json\/wp\/v2\/comments?post=43026"}],"version-history":[{"count":5,"href":"https:\/\/eshop.macsales.com\/blog\/wp-json\/wp\/v2\/posts\/43026\/revisions"}],"predecessor-version":[{"id":43032,"href":"https:\/\/eshop.macsales.com\/blog\/wp-json\/wp\/v2\/posts\/43026\/revisions\/43032"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/eshop.macsales.com\/blog\/wp-json\/wp\/v2\/media\/40335"}],"wp:attachment":[{"href":"https:\/\/eshop.macsales.com\/blog\/wp-json\/wp\/v2\/media?parent=43026"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/eshop.macsales.com\/blog\/wp-json\/wp\/v2\/categories?post=43026"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}