PT-2017-9363 · Bank Of Tokyo Mitsubishi Ufj · The Bank Of Tokyo-Mitsubishi Ufj

Reo Yoshida · Publicado 2017-08-02 · Atualizado 2017-08-07 · CVE-2016-7812

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Bank of Tokyo-Mitsubishi UFJ, Ltd. App for Android versions 5.3.1, 5.2.2 and earlier

Description The issue allows a man-in-the-middle attacker to downgrade the communication between the app and the server from TLS v1.2 to SSL v3.0, potentially enabling the attacker to eavesdrop on an encrypted communication.

Recommendations For versions 5.3.1, 5.2.2 and earlier, update the app to a version that enforces TLS v1.2 or later for communication with the server to prevent downgrade attacks.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2016-7812

Produtos afetados

The Bank Of Tokyo-Mitsubishi Ufj

Referências · 4

• https://osv.dev/vulnerability/CVE-2016-7812 · Aviso do Fabricante
• https://jvn.jp/en/vu/JVNVU92900492 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-7812 · Nota de Segurança
• http://securityfocus.com/bid/94829 · Nota