PT-2014-4398 · Demaecan · Demaecan

Published 2014-03-18 · Updated 2014-03-18 · CVE-2014-1976

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Demaecan application versions 2.1.0 and earlier

Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the Demaecan application does not verify X.509 certificates from SSL servers.

Recommendations For Demaecan application versions 2.1.0 and earlier, update to a version that properly verifies X.509 certificates from SSL servers to prevent man-in-the-middle attacks.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2014-1976

Affected Products

Demaecan

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-1976 · Security Note
• https://play.google.com/store/apps/details?id=com.demaecan.androidapp · Note
• http://jvn.jp/en/jp/JVN16263849/index.html · Note
• http://jvndb.jvn.jp/jvndb/JVNDB-2014-000030 · Note