Citrix ShareFile for Android SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	65670
Class:	Design Error
CVE:	CVE-2014-1910
Remote:	Yes
Local:	No
Published:	Feb 18 2014 12:00AM
Updated:	Feb 18 2014 12:00AM
Credit:	Alexandru Gherman of FortConsult
Vulnerable:	Citrix ShareFile for Android 2.2.3
Not Vulnerable:	Citrix ShareFile for Android 2.2.4

Citrix ShareFile for Android SSL Certificate Validation Security Bypass Vulnerability

Citrix ShareFile for Android is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

Versions prior to Citrix ShareFile for Android 2.4.4 are vulnerable.

Citrix ShareFile for Android SSL Certificate Validation Security Bypass Vulnerability

An attacker can use readily available network utilities to exploit this issue.

Citrix ShareFile for Android SSL Certificate Validation Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Citrix ShareFile for Android SSL Certificate Validation Security Bypass Vulnerability

References:

• Citrix ShareFile HomePage (Citrix Systems)
  
• SSL Certificate Validation Vulnerability in the Citrix ShareFile Mobile Applicat (Citrix Systems)