PT-2017-15318 · Rbb · Rbb Speed Test App For Ios+1

Digignome · Publicado 2017-08-02 · Atualizado 2017-08-04 · CVE-2017-2278

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions RBB SPEED TEST App for Android versions 2.0.3 and earlier RBB SPEED TEST App for iOS versions 2.1.0 and earlier

Description The issue concerns the failure to verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Recommendations For RBB SPEED TEST App for Android versions 2.0.3 and earlier, update to a version that properly verifies X.509 certificates. For RBB SPEED TEST App for iOS versions 2.1.0 and earlier, update to a version that properly verifies X.509 certificates. As a temporary workaround, consider disabling the use of SSL connections in the app until a patch is available.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2017-2278

Produtos afetados

Rbb Speed Test App For Android

Rbb Speed Test App For Ios

Referências · 3

• http://iid.co.jp/information/170714.html · Nota
• https://jvn.jp/en/jp/JVN24238648/index.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-2278 · Nota de Segurança