PT-2016-3177 · Kaspersky · Kaspersky Safe Browser

David Coomber · Published 2016-06-23 · Updated 2018-10-09 · CVE-2016-6231

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kaspersky Safe Browser iOS versions prior to 1.7.0

Description The issue is related to the lack of verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information via a crafted certificate. This can enable a remote attacker to gain confidential information by exploiting the vulnerability with a specially formed certificate.

Recommendations For versions prior to 1.7.0, update to version 1.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information when using the affected browser version until the update is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2017-02183

CVE-2016-6231

Affected Products

Kaspersky Safe Browser

References · 9

• https://bdu.fstec.ru/vul/2017-02183 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-6231 · Security Note
• https://osv.dev/vulnerability/CVE-2016-6231 · Vendor Advisory
• http://info-sec.ca/advisories/Kaspersky-Safe-Browser.html · Note
• https://support.kaspersky.com/vulnerability.aspx?el=12430#280716 · Note
• http://securityfocus.com/bid/92200 · Note
• http://securityfocus.com/archive/1/539071/100/0/threaded · Note
• http://securityfocus.com/archive/1/archive/1/539071/100/0/threaded · Note
• http://seclists.org/fulldisclosure/2016/Aug/30 · Note