PT-2024-38915 · Unknown · Anbox Stream Agent+1

Simon Fels · Published 2024-09-18 · Updated 2024-09-24 · CVE-2024-8287

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Anbox Management Service versions 1.17.0 through 1.23.0

Description: The issue concerns the failure to validate the TLS certificate provided by the Anbox Stream Agent. This could be exploited by an attacker who can intercept the communication between the Anbox Stream Agent and the Anbox Management Service from within an internal network.

Recommendations: For versions 1.17.0 through 1.23.0, consider implementing additional network security measures to prevent machine-in-the-middle attacks until a patch is available. As a temporary workaround, restrict access to the internal network to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2024-8287

Affected Products

Anbox Management Service

Anbox Stream Agent

References · 7

• https://discourse.ubuntu.com/t/anbox-cloud-1-23-1-has-been-released/48141 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-8287 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-8287 · Security Note
• https://bugs.launchpad.net/anbox-cloud/+bug/2077570 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8287 · Vendor Advisory
• https://t.me/cvedetector/6016 · Telegram Post
• https://twitter.com/CVEnew/status/1836534050921582646 · Twitter Post