Anywhere Pad-Meet, Collaborate for Android SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	70028
Class:	Design Error
CVE:	CVE-2014-5579
Remote:	Yes
Local:	No
Published:	Sep 03 2014 12:00AM
Updated:	Sep 03 2014 12:00AM
Credit:	Will Dormann of the CERT/CC
Vulnerable:	Anywherepad Anywhere Pad-Meet, Collaborate 4.0.1031 ~~~Android~
Not Vulnerable:

Anywhere Pad-Meet, Collaborate for Android SSL Certificate Validation Security Bypass Vulnerability

Anywhere Pad-Meet, Collaborate for Android is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

Anywhere Pad-Meet, Collaborate 4.0.1031 is vulnerable; other versions may also be affected.

Anywhere Pad-Meet, Collaborate for Android SSL Certificate Validation Security Bypass Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Anywhere Pad-Meet, Collaborate for Android SSL Certificate Validation Security Bypass Vulnerability

References:

• Anywhere Pad-Meet, Collaborate Homepage (Anywherepad)
  
• VU#582497 Multiple Android applications fail to properly validate SSL certificat (KB CERT)