Demaecan for Android CVE-2014-1976 SSL Certificate Validation Security Bypass Vulnerability
BID:66247
Info
Demaecan for Android CVE-2014-1976 SSL Certificate Validation Security Bypass Vulnerability
| Bugtraq ID: | 66247 |
| Class: | Design Error |
| CVE: |
CVE-2014-1976 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 17 2014 12:00AM |
| Updated: | Mar 17 2014 12:00AM |
| Credit: | kurisu and matt |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Demaecan for Android CVE-2014-1976 SSL Certificate Validation Security Bypass Vulnerability
Demaecan for Android is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates.
Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.
Versions prior to Demaecan for Android 2.0.1 are vulnerable.
Demaecan for Android is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates.
Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.
Versions prior to Demaecan for Android 2.0.1 are vulnerable.
Exploit / POC
Demaecan for Android CVE-2014-1976 SSL Certificate Validation Security Bypass Vulnerability
An attacker can use readily available network utilities to exploit this issue.
An attacker can use readily available network utilities to exploit this issue.
Solution / Fix
Demaecan for Android CVE-2014-1976 SSL Certificate Validation Security Bypass Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Demaecan for Android CVE-2014-1976 SSL Certificate Validation Security Bypass Vulnerability
References:
References: