Summaryinfo

A vulnerability classified as critical has been found in Deer Hunting Calls + Guide 4.0.1. This vulnerability affects unknown code of the component X.509 Certificate Handler. The manipulation leads to cryptographic issue. This vulnerability is uniquely identified as CVE-2014-6954. No exploit exists.

Detailsinfo

A vulnerability was found in Deer Hunting Calls + Guide 4.0.1 and classified as critical. This issue affects some unknown processing of the component X.509 Certificate Handler. The manipulation with an unknown input leads to a cryptographic issue vulnerability. Using CWE to declare the problem leads to CWE-310. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The Deer Hunting Calls + Guide (aka com.anawaz.deerhuntingcalls.free) application 4.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

The weakness was disclosed 10/16/2014 (Website). It is possible to read the advisory at docs.google.com. The identification of this vulnerability is CVE-2014-6954 since 09/19/2014. Access to the local network is required for this attack to succeed. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1600 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-71128, VDB-71956, VDB-71823 and VDB-71762 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Deer Hunting Calls + Guide

Version

• 4.0.1

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion