PT-2017-15710 · Samsung · Samsung Magician

Will Dormann · Published 2017-06-21 · Updated 2019-10-09 · CVE-2017-3218

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Samsung Magician versions prior to 5.0

Description The issue concerns the failure to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software updates.

Recommendations For versions prior to 5.0, consider updating to version 5.0 or later to enable HTTPS and proper TLS certificate validation for software updates.

Fix

Insufficient Verification of Data Authenticity

Missing Encryption of Sensitive Data

Improper Certificate Validation

Weakness Enumeration

CWE-345

CWE-311

CWE-295

Related Identifiers

CVE-2017-3218

Affected Products

Samsung Magician

References · 4

• https://osv.dev/vulnerability/CVE-2017-3218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3218 · Security Note
• https://kb.cert.org/vuls/id/846320 · Note
• http://securityfocus.com/bid/99081 · Note