Star Finanz S-Banking and S-Finanzstatus SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	45228
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 07 2010 12:00AM
Updated:	Dec 07 2010 12:00AM
Credit:	heise Security
Vulnerable:	Star Finanz S-Finanzstatus 0 Star Finanz S-Banking 0
Not Vulnerable:	Star Finanz S-Finanzstatus 1.6.3 Star Finanz S-Finanzstatus 1.5.3 Star Finanz S-Banking 1.6.3 Star Finanz S-Banking 1.5.3

Star Finanz S-Banking and S-Finanzstatus SSL Certificate Validation Security Bypass Vulnerability

Star Finanz S-Banking and S-Finanzstatus are prone to a security-bypass vulnerability because they fail to properly verify x.509 certificates.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers which will aid in further attacks.

Versions prior to S-Banking and S-Finanzstatus 1.6.3 for the iPhone and S-Banking and S-Finanzstatus 1.5.3 for the iPad are vulnerable.

Star Finanz S-Banking and S-Finanzstatus SSL Certificate Validation Security Bypass Vulnerability

Attackers use man-in-the-middle attacks to exploit this issue.

Star Finanz S-Banking and S-Finanzstatus SSL Certificate Validation Security Bypass Vulnerability

Solution:
Updates are available; please see the references for more information.

Star Finanz S-Banking and S-Finanzstatus SSL Certificate Validation Security Bypass Vulnerability

References:

• iPhone-Banking mit gravierenden Lücken (heise Security)
  
• S-Banking - Mobile Banking mit der Sparkasse (Star Finanz)
  
• S-Finanzstatus - Mobile Banking mit der Sparkasse (Star Finanz)