Flick a Trade For Android SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	70045
Class:	Design Error
CVE:	CVE-2014-5540
Remote:	Yes
Local:	No
Published:	Sep 03 2014 12:00AM
Updated:	Mar 19 2015 09:46AM
Credit:	Will Dormann of the CERT/CC
Vulnerable:
Not Vulnerable:

Flick a Trade For Android SSL Certificate Validation Security Bypass Vulnerability

Flick a Trade for Android is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

Flick a Trade 3.3 is vulnerable; other versions may also be affected.

Flick a Trade For Android SSL Certificate Validation Security Bypass Vulnerability

An attacker can use readily available network utilities to exploit this issue.

Flick a Trade For Android SSL Certificate Validation Security Bypass Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Flick a Trade For Android SSL Certificate Validation Security Bypass Vulnerability

References:

• Flick a Trade Homepage (Google)
  
• VU#582497 Multiple Android applications fail to properly validate SSL certificat (KB CERT)