CVE-2017-2402

Critical

Published: 02/04/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

An issue was discovered in certain Apple products, including macOS before 10.12.4, involving mishandling of profile uninstall actions in the 'MCX Client' component when a profile has multiple payloads. This allows remote attackers to bypass intended access restrictions.

Risk Assessment

Organizations may be exposed to attacks leveraging Active Directory certificate trust, potentially leading to unauthorized access to resources.

Recommendation

It is recommended to update macOS to version 10.12.4 or later to mitigate this vulnerability.

Original NVD description (English source)

An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves mishandling of profile uninstall actions in the "MCX Client" component when a profile has multiple payloads. It allows remote attackers to bypass intended access restrictions by leveraging Active Directory certificate trust that should not have remained.