NVD

Id
46594  
Name
CVE-2012-5456  
Description
The Zoner AntiVirus Free application for Android does not verify that the server hostname matches a domain name in the subject"s Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, as demonstrated by a server used for updating virus signature files.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2012-10-24  
Modified Date
2015-11-04  
Seq
2012-5456  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
233343 46594 CVE-2012-5456 56292  View
233344 46594 CVE-2012-5456 http://www2.dcsec.uni-hannover.de/files/android/p50-fahl.pdf  View
233345 46594 CVE-2012-5456 zoner-android-spoofing(79591)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
29417 JVNDB-2012-005124 Zoner AntiVirus Free application for Android における SSL サーバを偽装される脆弱性 Zoner AntiVirus Free application for Android は、サーバホスト名と X.509 証明書上の subject の Common Name (CN) フィールドのドメイン名を照合しないため、SSL サーバを偽装される脆弱性が存在します。 CVE-2012-5456 58694 CVE-2012-5456 46594 4.3 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-005124.html 2012-10-24 2016-02-18 View