PT-2017-9363 · Bank Of Tokyo Mitsubishi Ufj · The Bank Of Tokyo-Mitsubishi Ufj

Reo Yoshida · Published 2017-08-02 · Updated 2017-08-07 · CVE-2016-7812

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Bank of Tokyo-Mitsubishi UFJ, Ltd. App for Android versions 5.3.1, 5.2.2 and earlier

Description The issue allows a man-in-the-middle attacker to downgrade the communication between the app and the server from TLS v1.2 to SSL v3.0, potentially enabling the attacker to eavesdrop on an encrypted communication.

Recommendations For versions 5.3.1, 5.2.2 and earlier, update the app to a version that enforces TLS v1.2 or later for communication with the server to prevent downgrade attacks.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2016-7812

Affected Products

The Bank Of Tokyo-Mitsubishi Ufj

References · 4

• https://osv.dev/vulnerability/CVE-2016-7812 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7812 · Security Note
• https://jvn.jp/en/vu/JVNVU92900492 · Note
• http://securityfocus.com/bid/94829 · Note