eBay PayPal for iOS-based Mobile Devices SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	44657
Class:	Design Error
CVE:	CVE-2010-4211
Remote:	Yes
Local:	No
Published:	Nov 04 2010 12:00AM
Updated:	Apr 13 2015 09:02PM
Credit:	unknown
Vulnerable:
Not Vulnerable:

eBay PayPal for iOS-based Mobile Devices SSL Certificate Validation Security Bypass Vulnerability

eBay PayPal is prone to a security-bypass vulnerability because it fails to properly verify x.509 certificates.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers which will aid in further attacks.

NOTE: This issue affects connections on unsecured Wi-Fi networks.

Versions prior to PayPal 3.0.1 for iOS-based mobile devices are vulnerable.

eBay PayPal for iOS-based Mobile Devices SSL Certificate Validation Security Bypass Vulnerability

Attackers use man-in-the-middle attacks to exploit this issue.

eBay PayPal for iOS-based Mobile Devices SSL Certificate Validation Security Bypass Vulnerability

Solution:
The vendor recommends users upgrade to the latest Paypal IOS mobile application [3.0.1] immediately. Please see the references for more information.

eBay PayPal for iOS-based Mobile Devices SSL Certificate Validation Security Bypass Vulnerability

References:

• PayPal iTunes Preview (Apple)
  
• PayPal Mobile Homepage (eBay)
  
• PayPal Races To Fix IPhone App Security Flaw (SPENCER E. ANTE)