JVN Info.

Id
17161  
Name
JVNDB-2014-006036  
Title
Android 用 BIKE RACING 2014 アプリケーションにおけるサーバになりすまされる脆弱性  
Summary
Android 用 BIKE RACING 2014 (別名 com.timuzsolutions.bikeracing2014) アプリケーションは、SSL サーバからの X.509 証明書を検証しないため、サーバになりすまされ、重要な情報を取得される脆弱性が存在します。  
Nvdinfo
CVE-2014-5719  
Cvssv2
5.4  
Jvnurl
http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-006036.html  
Published Date
2014-09-03  
Registered Date
2014-12-17  
Last Updated Date
2014-12-17  

Actions

Related Nessuslogs

Id Log ID Jvninfo Id Plugin ID CVE CVSS Risk Host Protocol Port Name Synopsis Description Solution See Also Plugin Output Actions
50937 H28_MUN_DWEB_Q4_172_16_211_0_seg.csv 17161 89058 CVE-2016-0800 4 Medium 172.16.211.54 tcp 443 SSL DROWN Attack Vulnerability (Decrypting RSA with Obsolete and Weakened eNcryption) The remote host may be affected by a vulnerability that allows a remote attacker to potentially decrypt captured TLS traffic. The remote host supports SSLv2 and therefore may be affected by a vulnerability that allows a cross-protocol Bleichenbacher padding oracle attack known as DROWN (Decrypting RSA with Obsolete and Weakened eNcryption). This vulnerability exists due to a flaw in the Secure Sockets Layer Version 2 (SSLv2) implementation, and it allows captured TLS traffic to be decrypted. A man-in-the-middle attacker can exploit this to decrypt the TLS connection by utilizing previously captured traffic and weak cryptography along with a series of specially crafted connections to an SSLv2 server that uses the same private key. Disable SSLv2 and export grade cryptography cipher suites. Ensure that private keys are not used anywhere with server software that supports SSLv2 connections. https://drownattack.com/ https://drownattack.com/drown-attack-paper.pdf The remote host is affected by SSL DROWN and supports the following vulnerable cipher suites : Low Strength Ciphers (<= 64-bit key) SSLv2 DES-CBC-MD5 Kx=RSA Au=RSA Enc=DES-CBC(56) Mac=MD5 EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2-CBC(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export High Strength Ciphers (>= 112-bit key) SSLv2 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 The fields above are : {OpenSSL ciphername} Kx={key exchange} Au={authentication} Enc={symmetric encryption method} Mac={message authentication code} {export flag}
54489 1_Tokyu_remi_20170126.csv 17161 89058 CVE-2016-0800 4 Medium 54.199.215.149 tcp 443 SSL DROWN Attack Vulnerability (Decrypting RSA with Obsolete and Weakened eNcryption) The remote host may be affected by a vulnerability that allows a remote attacker to potentially decrypt captured TLS traffic. The remote host supports SSLv2 and therefore may be affected by a vulnerability that allows a cross-protocol Bleichenbacher padding oracle attack known as DROWN (Decrypting RSA with Obsolete and Weakened eNcryption). This vulnerability exists due to a flaw in the Secure Sockets Layer Version 2 (SSLv2) implementation, and it allows captured TLS traffic to be decrypted. A man-in-the-middle attacker can exploit this to decrypt the TLS connection by utilizing previously captured traffic and weak cryptography along with a series of specially crafted connections to an SSLv2 server that uses the same private key. Disable SSLv2 and export grade cryptography cipher suites. Ensure that private keys are not used anywhere with server software that supports SSLv2 connections. https://drownattack.com/ https://drownattack.com/drown-attack-paper.pdf The remote host is affected by SSL DROWN and supports the following vulnerable cipher suites : Low Strength Ciphers (<= 64-bit key) SSLv2 DES-CBC-MD5 Kx=RSA Au=RSA Enc=DES-CBC(56) Mac=MD5 High Strength Ciphers (>= 112-bit key) SSLv2 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 The fields above are : {OpenSSL ciphername} Kx={key exchange} Au={authentication} Enc={symmetric encryption method} Mac={message authentication code} {export flag}
56119 H28_DWEB_NW_Scan_Q1_172_16_211_Seg_20160518_xux6yw.csv 17161 89058 CVE-2016-0800 4 Medium 172.16.211.54 tcp 443 SSL DROWN Attack Vulnerability (Decrypting RSA with Obsolete and Weakened eNcryption) The remote host may be affected by a vulnerability that allows a remote attacker to potentially decrypt captured TLS traffic. The remote host supports SSLv2 and therefore may be affected by a vulnerability that allows a cross-protocol Bleichenbacher padding oracle attack known as DROWN (Decrypting RSA with Obsolete and Weakened eNcryption). This vulnerability exists due to a flaw in the Secure Sockets Layer Version 2 (SSLv2) implementation, and it allows captured TLS traffic to be decrypted. A man-in-the-middle attacker can exploit this to decrypt the TLS connection by utilizing previously captured traffic and weak cryptography along with a series of specially crafted connections to an SSLv2 server that uses the same private key. Disable SSLv2 and export grade cryptography cipher suites. Ensure that private keys are not used anywhere with server software that supports SSLv2 connections. https://drownattack.com/ https://drownattack.com/drown-attack-paper.pdf The remote host is affected by SSL DROWN and supports the following vulnerable cipher suites : Low Strength Ciphers (<= 64-bit key) SSLv2 DES-CBC-MD5 Kx=RSA Au=RSA Enc=DES-CBC(56) Mac=MD5 EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2-CBC(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export High Strength Ciphers (>= 112-bit key) SSLv2 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 The fields above are : {OpenSSL ciphername} Kx={key exchange} Au={authentication} Enc={symmetric encryption method} Mac={message authentication code} {export flag}
58223 H28_DWeb_NWScan_Q1_192_168_242_Seg.csv 17161 89058 CVE-2016-0800 4 Medium 192.168.242.112 tcp 443 SSL DROWN Attack Vulnerability (Decrypting RSA with Obsolete and Weakened eNcryption) The remote host may be affected by a vulnerability that allows a remote attacker to potentially decrypt captured TLS traffic. The remote host supports SSLv2 and therefore may be affected by a vulnerability that allows a cross-protocol Bleichenbacher padding oracle attack known as DROWN (Decrypting RSA with Obsolete and Weakened eNcryption). This vulnerability exists due to a flaw in the Secure Sockets Layer Version 2 (SSLv2) implementation, and it allows captured TLS traffic to be decrypted. A man-in-the-middle attacker can exploit this to decrypt the TLS connection by utilizing previously captured traffic and weak cryptography along with a series of specially crafted connections to an SSLv2 server that uses the same private key. Disable SSLv2 and export grade cryptography cipher suites. Ensure that private keys are not used anywhere with server software that supports SSLv2 connections. https://drownattack.com/ https://drownattack.com/drown-attack-paper.pdf The remote host is affected by SSL DROWN and supports the following vulnerable cipher suites : High Strength Ciphers (>= 112-bit key) SSLv2 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 The fields above are : {OpenSSL ciphername} Kx={key exchange} Au={authentication} Enc={symmetric encryption method} Mac={message authentication code} {export flag}