SPCanywhere CVE-2015-1596 SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	72972
Class:	Design Error
CVE:	CVE-2015-1596
Remote:	Yes
Local:	No
Published:	Mar 05 2015 12:00AM
Updated:	Mar 05 2015 12:00AM
Credit:	Karsten Sohr, Bernhard Berger, and Kai Hillmann from the TZI-Bremen
Vulnerable:	Siemens SPCanywhere 0
Not Vulnerable:

SPCanywhere CVE-2015-1596 SSL Certificate Validation Security Bypass Vulnerability

SPCanywhere is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

SPCanywhere CVE-2015-1596 SSL Certificate Validation Security Bypass Vulnerability

An attacker can use readily available network utilities to exploit this issue.

SPCanywhere CVE-2015-1596 SSL Certificate Validation Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

SPCanywhere CVE-2015-1596 SSL Certificate Validation Security Bypass Vulnerability

References:

• Siemens Homepage (Siemens)
  
• (ICSA-15-064-05) Siemens SPCanywhere App Vulnerabilities (CERT)
  
• SSA-185226: Vulnerabilities in App SPCanywhere (Siemens)