PT-2017-7560 · Good · Good For Enterprise

Tobias Ospelt · Publicado 2017-09-20 · Atualizado 2017-10-04 · CVE-2015-9232

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Good for Enterprise application version 3.0.0.415

Description The issue concerns the lack of signature protection for the Authentication Delegation API intent in the Good for Enterprise application. Additionally, the Good Dynamic application activation process fails to detect malicious activation attempts involving modified names starting with a com.good.gdgma substring. This could allow an attacker to gain access to intranet data, but only if a malicious Android application has already been downloaded by the user.

Recommendations For Good for Enterprise application version 3.0.0.415, consider restricting access to the Authentication Delegation API intent until a fix is available, and ensure that the Good Dynamic application activation process is modified to detect malicious activation attempts involving modified names starting with a com.good.gdgma substring.

Exploit

Correção

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

Identificadores relacionados

CVE-2015-9232

Produtos afetados

Good For Enterprise

Referências · 4

• 🔥 http://securityfocus.com/archive/1/536543 · Exploit
• 🔥 https://modzero.ch/advisories/MZ-15-03-GOOD-Auth-Delegation.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-9232 · Nota de Segurança
• https://community.blackberry.com/community/blogs/blog/2015/10/02/what-you-need-to-know-modzero-insecure-application-coupling · Nota