CVE-2015-5639 : niconico App for iOS before 6.38 does not verify SSL certificates which could allow remote attackers to execute man-in-t

niconico App for iOS before 6.38 does not verify SSL certificates which could allow remote attackers to execute man-in-the-middle attacks.

Published 2017-10-10 16:29:00

Updated 2017-11-05 22:40:43

Source JPCERT/CC

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2015-5639

EPSS FAQ

0.17%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 53 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-5639

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:N	8.6	4.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
7.4	HIGH	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	2.2	5.2	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None

References for CVE-2015-5639

http://jvn.jp/en/jp/JVN20355129/index.html

JVN#20355129: niconico App for iOS fails to verify SSL server certificates
Third Party Advisory;VDB Entry
http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000137.html

JVNDB-2015-000137 - JVN iPedia
Third Party Advisory;VDB Entry
http://www.securityfocus.com/bid/76906

niconico App for iOS CVE-2015-56 SSL Certificate Validation Security Bypass Vulnerability
Third Party Advisory;VDB Entry
http://blog.nicovideo.jp/niconews/ni055746.html

iOS版「niconico」アプリにおける脆弱性と、セキュリティ強化について‐ニコニコインフォ
Vendor Advisory

Products affected by CVE-2015-5639

Dwango » Niconico » For Iphone Os
Versions up to, including, (<=) 6.37
cpe:2.3:a:dwango:niconico:*:*:*:*:*:iphone_os:*:*
Matching versions