PT-2017-6880 · Ana · Ana App For Android+1

Aoki Keiichi · Publicado 2017-09-25 · Atualizado 2017-10-06 · CVE-2015-5666

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ANA App for Android versions 3.1.1 and earlier ANA App for iOS versions 3.3.6 and earlier

Description The issue concerns the failure to verify SSL certificates. This could potentially allow for man-in-the-middle attacks. No information is provided about the estimated number of affected devices or real-world incidents.

Recommendations For ANA App for Android versions 3.1.1 and earlier, update to a version that verifies SSL certificates. For ANA App for iOS versions 3.3.6 and earlier, update to a version that verifies SSL certificates.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2015-5666

Produtos afetados

Ana App For Android

Ana App For Ios

Referências · 4

• http://jvn.jp/en/jp/JVN25086409/index.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-5666 · Nota de Segurança
• http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000164.html · Nota
• http://securityfocus.com/bid/77344 · Nota