NTT Photopt Android SSL Certificate Verification Bypass (CVE-2016-1198)

Vulnerability Overview Vulnerability ID: JVND0B-2016-000050 Vulnerability Name: Photopt App fails to verify SSL server certificates Reporter: Yuto Iso Disclosure Date: 2017/05/23 CVSS Scores CVSS v3 Severity: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None - Overall Score: 4.8 CVSS v2 Severity: - Access Vector: Network - Access Complexity: High - Authentication: None - Confidentiality Impact: Partial - Integrity Impact: Partial - Availability Impact: None - Overall Score: 4.0 Affected Products Vendor: NTT Communications Corporation Product Versions: - Photopt for Android 1.0.0, 1.1.0 Impact May allow attackers to perform man-in-the-middle attacks on encrypted communications, enabling eavesdropping on encrypted data. Solution Update the software to the latest version. Vendor Information NTT Communications Corporation: - Photopt - Android Apps on Google Play (Japanese) - NTT Communications Corporation website (Japanese) CWE Information CWE: No Mapping (CWE-Other) CVE ID CVE-2016-1198 References JVN: JVN#11815655 National Vulnerability Database (NVD): CVE-2016-1198 Revision History 2016/04/19: Webpage published 2016/05/24: Vendor information added 2017/05/23: References added

Goal Reached Thanks to every supporter — we hit 100%!

NTT Photopt Android SSL Certificate Verification Bypass (CVE-2016-1198)