Google News and Weather CVE-2017-9245 Man-in-the-Middle Security Bypass Vulnerability

Bugtraq ID:	99892
Class:	Design Error
CVE:	CVE-2017-9245
Remote:	Yes
Local:	No
Published:	Jul 18 2017 12:00AM
Updated:	Jul 18 2017 12:00AM
Credit:	nightwatchcyber
Vulnerable:	Google News and Weather 3.1.4
Not Vulnerable:	Google News and Weather 3.3.1

Google News and Weather CVE-2017-9245 Man-in-the-Middle Security Bypass Vulnerability

Google News and Weather is prone to a security-bypass vulnerability.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks and perform unauthorized actions.

Google News and Weather 3.1.4 is vulnerable; other versions may also be affected.

Google News and Weather CVE-2017-9245 Man-in-the-Middle Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Google News and Weather CVE-2017-9245 Man-in-the-Middle Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Google News and Weather CVE-2017-9245 Man-in-the-Middle Security Bypass Vulnerability

References:

• Google Homepage (Google)
  
• Advisory: Google�??s Android News and Weather App Doesn�??t Always Use SSL [CVE-2017 (nightwatchcybersecurity)