Description
The MCX Desktop Config Profiles implementation in Apple OS X before 10.10 retains web-proxy settings from uninstalled mobile-configuration profiles, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging access to an unintended proxy server.
References
- macosx-cve20144440-sec-bypass(97628) vdb-entry
- APPLE-SA-2014-10-16-1 vendor-advisory
- 1031063 vdb-entry
- 70631 vdb-entry
- https://support.apple.com/kb/HT6535