jigbrowser+ for Android 'WebView' Class Information Disclosure Vulnerability

Bugtraq ID:	58801
Class:	Design Error
CVE:	CVE-2012-4017
Remote:	Yes
Local:	No
Published:	Sep 28 2012 12:00AM
Updated:	Sep 28 2012 12:00AM
Credit:	Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc.
Vulnerable:	Jig.jp co jigbrowser+ 1.1.1
Not Vulnerable:	Jig.jp co jigbrowser+ 1.5.0

jigbrowser+ for Android 'WebView' Class Information Disclosure Vulnerability

jigbrowser+ for Android is prone to an information-disclosure vulnerability.

Remote attackers can exploit this issue to gain access to sensitive information. This may aid in further attacks.

Versions prior to jigbrowser+ 1.5.0 are vulnerable.

jigbrowser+ for Android 'WebView' Class Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

jigbrowser+ for Android 'WebView' Class Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

jigbrowser+ for Android 'WebView' Class Information Disclosure Vulnerability

References:

• jigbrowser+ HomePage (Google)
  
• jigbrowser+ for Android vulnerable in the WebView class (JPCERT)
  
• jigbrowser+ for Android vulnerable in the WebView class (JPCERT)