PT-2017-15710 · Samsung · Samsung Magician

Will Dormann · Publicado 2017-06-21 · Atualizado 2019-10-09 · CVE-2017-3218

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Samsung Magician versions prior to 5.0

Description The issue concerns the failure to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software updates.

Recommendations For versions prior to 5.0, consider updating to version 5.0 or later to enable HTTPS and proper TLS certificate validation for software updates.

Correção

Insufficient Verification of Data Authenticity

Missing Encryption of Sensitive Data

Improper Certificate Validation

Enumeração de Fraquezas

CWE-345

CWE-311

CWE-295

Identificadores relacionados

CVE-2017-3218

Produtos afetados

Samsung Magician

Referências · 4

• https://kb.cert.org/vuls/id/846320 · Nota
• https://osv.dev/vulnerability/CVE-2017-3218 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-3218 · Nota de Segurança
• http://securityfocus.com/bid/99081 · Nota