Flash Seats Mobile App on Android/iOS SSL Certificate Validator certificate validation
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
6.3 | $0-$5k | 0.00 |
A vulnerability classified as critical has been found in Flash Seats Mobile App on Android/iOS (the affected version unknown). Affected is an unknown part of the component SSL Certificate Validator. The manipulation with an unknown input leads to a certificate validation vulnerability. CWE is classifying the issue as CWE-295. The product does not validate, or incorrectly validates, a certificate. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:
Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle (MITM) attacks.
The bug was discovered 03/08/2017. The weakness was released 12/16/2017 by Will Dormann with CERT/CC as confirmed advisory (CERT.org). The advisory is shared for download at kb.cert.org. This vulnerability is traded as CVE-2017-3190 since 12/05/2016. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1587.003.
The vulnerability was handled as a non-public zero-day exploit for at least 282 days. During that time the estimated underground price was around $0-$5k.
Applying a patch is able to eliminate this problem.
Product
Name
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.5VulDB Meta Temp Score: 6.4
VulDB Base Score: 5.6
VulDB Temp Score: 5.4
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 7.5
NVD Vector: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Certificate validationCWE: CWE-295 / CWE-287
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
0-Day Time: 🔍
Timeline
12/05/2016 🔍03/08/2017 🔍
03/08/2017 🔍
12/15/2017 🔍
12/16/2017 🔍
12/16/2017 🔍
12/15/2019 🔍
Sources
Advisory: kb.cert.orgResearcher: Will Dormann
Organization: CERT/CC
Status: Confirmed
CVE: CVE-2017-3190 (🔍)
SecurityFocus: 96719 - Flash Seats for iOS CVE-2017-3190 SSL Certificate Validation Security Bypass Vulnerability
scip Labs: https://www.scip.ch/en/?labs.20130704
Entry
Created: 12/16/2017 16:29Updated: 12/15/2019 15:50
Changes: 12/16/2017 16:29 (64), 12/15/2019 15:50 (1)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.