PT-2016-3177 · Kaspersky · Kaspersky Safe Browser

David Coomber · Publicado 2016-06-23 · Atualizado 2018-10-09 · CVE-2016-6231

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kaspersky Safe Browser iOS versions prior to 1.7.0

Description The issue is related to the lack of verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information via a crafted certificate. This can enable a remote attacker to gain confidential information by exploiting the vulnerability with a specially formed certificate.

Recommendations For versions prior to 1.7.0, update to version 1.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information when using the affected browser version until the update is applied.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2017-02183

CVE-2016-6231

Produtos afetados

Kaspersky Safe Browser

Referências · 9

• https://bdu.fstec.ru/vul/2017-02183 · Nota de Segurança
• http://info-sec.ca/advisories/Kaspersky-Safe-Browser.html · Nota
• https://support.kaspersky.com/vulnerability.aspx?el=12430#280716 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-6231 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-6231 · Aviso do Fabricante
• http://securityfocus.com/bid/92200 · Nota
• http://securityfocus.com/archive/1/539071/100/0/threaded · Nota
• http://securityfocus.com/archive/1/archive/1/539071/100/0/threaded · Nota
• http://seclists.org/fulldisclosure/2016/Aug/30 · Nota