QQ Copy CVE-2014-5605 SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	70125
Class:	Design Error
CVE:	CVE-2014-5605
Remote:	Yes
Local:	No
Published:	Sep 08 2014 12:00AM
Updated:	Sep 08 2014 12:00AM
Credit:	Will Dormann of the CERT/CC
Vulnerable:	Digimobistudio Qq Copy 1.0 ~~~Android~~
Not Vulnerable:

QQ Copy CVE-2014-5605 SSL Certificate Validation Security Bypass Vulnerability

QQ Copy for Android is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

QQ Copy 1.0 is vulnerable; other versions may also be affected.

QQ Copy CVE-2014-5605 SSL Certificate Validation Security Bypass Vulnerability

An attacker can use readily available network utilities to exploit this issue.

QQ Copy CVE-2014-5605 SSL Certificate Validation Security Bypass Vulnerability

References:

• QQ Copy Homepage (digimobistudio)
  
• VU#582497 Multiple Android applications fail to properly validate SSL certificat (KB CERT)