PT-2012-6122 · Jpmorgan Chase · Chase Mobile Banking Application

CVE-2012-5810 · Publicado 2012-11-04 · Atualizado 2024-02-14

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Chase mobile banking application for Android (affected versions not specified)

Description The issue concerns a failure to verify the server hostname against the domain name in the X.509 certificate's Common Name (CN) or subjectAltName field. This allows man-in-the-middle attackers to spoof SSL servers using any valid certificate, due to the override of the default X509TrustManager. It is noted that this issue was fixed in the summer of 2012.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2012-5810

Produtos afetados

Chase Mobile Banking Application

Referências · 3

• 🔥 http://cs.utexas.edu/~shmat/shmat_ccs12.pdf · Exploit
• https://docs.google.com/document/pub?id=1roBIeSJsYq3Ntpf6N0PIeeAAvu4ddn7mGo6Qb7aL7ew · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-5810 · Nota de Segurança