PT-2018-9516 · Subsonic · Dsub For Subsonic

Publicado 2018-09-06 · Atualizado 2018-12-12 · CVE-2018-1000664

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions DSub for Subsonic (Android client) version 5.4.1

Description The issue concerns improper certificate validation in the HTTPS client, allowing any non-CA signed server certificate, including self-signed and expired certificates, to be accepted by the client. This can be exploited when the victim connects to a server that is being MITM/Proxied by an attacker.

Recommendations For DSub for Subsonic (Android client) version 5.4.1, consider disabling the HTTPS client functionality until a patch is available that properly validates server certificates. Restrict connections to only trusted servers to minimize the risk of exploitation.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2018-1000664

Produtos afetados

Dsub For Subsonic

Referências · 3

• https://github.com/daneren2005/Subsonic/issues/60 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000664 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1000664 · Aviso do Fabricante