CVE-2017-2380

High

Published: 02/04/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

An issue was discovered in certain Apple products, including iOS before 10.3, related to the SCEP implementation in the 'Profiles' component. It allows remote attackers to bypass cryptographic protection mechanisms by leveraging DES support.

Risk Assessment

Attackers may gain access to sensitive data, posing a serious threat to the security of systems using the vulnerable version of iOS.

Recommendation

It is recommended to update iOS to version 10.3 or later to mitigate this vulnerability.

Other vulnerabilities in Profiles

CVE-2016-7626High
An issue was discovered in certain Apple products, including iOS before 10.2, tvOS before 10.1, and watchOS before 3.1.1, involving the 'Profiles' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted certificate profile.

Original NVD description (English source)

An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the Simple Certificate Enrollment Protocol (SCEP) implementation in the "Profiles" component. It allows remote attackers to bypass cryptographic protection mechanisms by leveraging DES support.