Zoho Site24x7 Mobile Network Poller SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	101091
Class:	Design Error
CVE:	CVE-2017-14582
Remote:	Yes
Local:	No
Published:	Oct 03 2017 12:00AM
Updated:	Oct 03 2017 12:00AM
Credit:	Yakov Shafranovich.
Vulnerable:	Zoho Site24x7 0
Not Vulnerable:	Zoho Site24x7 1.1.5

Zoho Site24x7 Mobile Network Poller SSL Certificate Validation Security Bypass Vulnerability

Zoho Site24x7 Mobile Network Poller is prone to a security-bypass vulnerability.

Successful exploits may allow attackers to perform man-in-the-middle attacks or impersonate trusted clients, which will aid in further attacks.

Versions of Zoho Site24x7 Mobile Network Poller prior to 1.1.5 are vulnerable.

Zoho Site24x7 Mobile Network Poller SSL Certificate Validation Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Zoho Site24x7 Mobile Network Poller SSL Certificate Validation Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Zoho Site24x7 Mobile Network Poller SSL Certificate Validation Security Bypass Vulnerability

References:

• Zoho Homepage (Zoho)
  
• Zoho Site24x7 Mobile Network Poller for Android Didn�??t Properly Validate SSL [CV (Nightwatch)