PT-2016-1598 · Google · Android+1

Chad Brubaker · Published 2016-03-12 · Updated 2016-11-28 · CVE-2016-0818

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Conscrypt versions prior to 4.4.4 in Android 4.x Conscrypt versions prior to 5.1.1 LMY49H in Android 5.x Conscrypt versions prior to 2016-03-01 in Android 6.x

Description The caching functionality in the TrustManagerImpl class in Conscrypt mishandles the distinction between an intermediate CA and a trusted root CA. This issue allows man-in-the-middle attackers to spoof servers by leveraging access to an intermediate CA to issue a certificate. The vulnerability is related to errors in security settings and can be exploited by a remote attacker to substitute servers using access to intermediate certificate centers.

Recommendations For Conscrypt in Android 4.x, update to version 4.4.4 or later. For Conscrypt in Android 5.x, update to version 5.1.1 LMY49H or later. For Conscrypt in Android 6.x, update to a version released after 2016-03-01.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

CWE-254

Related Identifiers

BDU:2016-00899

CVE-2016-0818

Affected Products

Android

Conscrypt

References · 10

• https://bdu.fstec.ru/vul/2016-00899 · Security Note
• http://source.android.com/security/bulletin/2016-03-01.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-0818 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-0818 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-0818 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0818 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0818 · Security Note
• http://securityfocus.com/bid/84245 · Note
• https://android.googlesource.com/platform/external/conscrypt/+/c4ab1b959280413fb11bf4fd7f6b4c2ba38bd779 · Note
• https://android.googlesource.com/platform/external/conscrypt/+/4c9f9c2201116acf790fca25af43995d29980ee0 · Note