PT-2017-7560 · Good · Good For Enterprise

Tobias Ospelt · Published 2017-09-20 · Updated 2017-10-04 · CVE-2015-9232

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Good for Enterprise application version 3.0.0.415

Description The issue concerns the lack of signature protection for the Authentication Delegation API intent in the Good for Enterprise application. Additionally, the Good Dynamic application activation process fails to detect malicious activation attempts involving modified names starting with a com.good.gdgma substring. This could allow an attacker to gain access to intranet data, but only if a malicious Android application has already been downloaded by the user.

Recommendations For Good for Enterprise application version 3.0.0.415, consider restricting access to the Authentication Delegation API intent until a fix is available, and ensure that the Good Dynamic application activation process is modified to detect malicious activation attempts involving modified names starting with a com.good.gdgma substring.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2015-9232

Affected Products

Good For Enterprise

References · 4

• 🔥 http://securityfocus.com/archive/1/536543 · Exploit
• 🔥 https://modzero.ch/advisories/MZ-15-03-GOOD-Auth-Delegation.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-9232 · Security Note
• https://community.blackberry.com/community/blogs/blog/2015/10/02/what-you-need-to-know-modzero-insecure-application-coupling · Note