Anyone can log in as root on MacOS High Sierra

[cobito]

Well, a flaw has been discovered that allows you to log in as root without knowing the root password. In fact, it's as simple as not entering any password and trying to log in several times. On one of those attempts, you'll succeed. The incredible thing is that this has been known for a couple of weeks although the discovery has spread in the last few hours.

There is a discussion of the topic here.

[Bm4n]

The patch, go to "Directory Utility" unlock with our user and password and in the menu "edit" > "change root user password" > we enter a password and that's it.

[Bm4n]

@bm4n I take back what I said, it made my boot super slow the other day, I don't know if it was because of that. Now with the last update the root is deactivated and it's supposed to be fixed.

http://osxdaily.com/2017/11/30/macos-high-sierra-17b1003-supplemental-security-update-fix/

Regards