CVE-2018-0691 Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.280...
MediumCVSS 5.9
EPSS 0.67%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23) do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| KDDI CORPORATION + message | < 1.0.6 | 1.0.6 |
| KDDI CORPORATION + message | < 1.1.23 | 1.1.23 |
| ntttocomo + message | < 42.40.2800 | 42.40.2800 |
| softbank + message | < 10.1.7 | 10.1.7 |
| softbank + message | < 1.1.23 | 1.1.23 |
| ntt tocomo + message | < 1.1.23 | 1.1.23 |
| Softbank, NTT docomo, KDDI Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1 | = Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO + | No fix listed |
References
- JVN#37288228 third-party-advisory
- www.au.com patch vendor-advisory
- www.nttdocomo.co.jp patch vendor-advisory
- www.softbank.jp patch vendor-advisory