PT-2017-6880 · Ana · Ana App For Android+1

Aoki Keiichi · Published 2017-09-25 · Updated 2017-10-06 · CVE-2015-5666

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ANA App for Android versions 3.1.1 and earlier ANA App for iOS versions 3.3.6 and earlier

Description The issue concerns the failure to verify SSL certificates. This could potentially allow for man-in-the-middle attacks. No information is provided about the estimated number of affected devices or real-world incidents.

Recommendations For ANA App for Android versions 3.1.1 and earlier, update to a version that verifies SSL certificates. For ANA App for iOS versions 3.3.6 and earlier, update to a version that verifies SSL certificates.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2015-5666

Affected Products

Ana App For Android

Ana App For Ios

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-5666 · Security Note
• http://jvn.jp/en/jp/JVN25086409/index.html · Note
• http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000164.html · Note
• http://securityfocus.com/bid/77344 · Note