CVE-2017-13872

High

Published: 29/11/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

An issue was discovered in certain Apple products, including macOS High Sierra before Security Update 2017-001, related to the 'Directory Utility' component. It allows attackers to obtain administrator access without a password via certain interactions involving entry of the root user name.

Risk Assessment

Organizations may be exposed to unauthorized access to systems, potentially leading to serious security breaches and data loss.

Recommendation

It is recommended to promptly install Security Update 2017-001 to mitigate this vulnerability.

Other vulnerabilities in Directory Utility

CVE-2015-6980High
Directory Utility in Apple OS X before 10.11.1 mishandles authentication for new sessions, which allows local users to gain privileges via unspecified vectors.

Original NVD description (English source)

An issue was discovered in certain Apple products. macOS High Sierra before Security Update 2017-001 is affected. The issue involves the "Directory Utility" component. It allows attackers to obtain administrator access without a password via certain interactions involving entry of the root user name.