PT-2017-8535 · Dmmfx+1 · Dmmfx Trade+2

Gaku Taniguchi · Published 2017-04-20 · Updated 2017-04-26 · CVE-2016-4818

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DMMFX Trade for Android versions 1.5.0 and earlier DMMFX DEMO Trade for Android versions 1.5.0 and earlier GAITAMEJAPAN FX Trade for Android versions 1.4.0 and earlier

Description The issue is related to the failure to verify SSL certificates. This could potentially allow for man-in-the-middle attacks.

Recommendations For DMMFX Trade for Android versions 1.5.0 and earlier, update to a version that properly verifies SSL certificates. For DMMFX DEMO Trade for Android versions 1.5.0 and earlier, update to a version that properly verifies SSL certificates. For GAITAMEJAPAN FX Trade for Android versions 1.4.0 and earlier, update to a version that properly verifies SSL certificates.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2016-4818

Affected Products

Dmmfx Demo Trade

Dmmfx Trade

Gaitamejapan Fx Trade

References · 7

• https://osv.dev/vulnerability/CVE-2016-4818 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4818 · Security Note
• http://fx.dmm.com/information/press/2016/2016053001 · Vendor Advisory
• https://jvn.jp/en/jp/JVN40898764/995849/index.html · Note
• http://gaitamejapan.com/support/news/2016/2016053001 · Note
• http://jvn.jp/en/jp/JVN40898764/index.html · Note
• http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000092.html · Note