VulnerabilityModified

CVE-2018-0691

MEDIUM 5.9EPSS 0.67%

Does this matter?

Lower severity and a low EPSS score (0.67%). Track it; it rarely justifies an emergency change on its own.

Description

Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23) do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVSS 3.0: 5.9 MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.67% probability · 50th percentile
CISA KEV: Not listed
Weakness: CWE-295
Affected: kddi/\+ message · ntttocomo/\+ message · softbank/\+ message · ntt tocomo/\+ message
Source: vultures@jpcert.or.jp

References

http://jvn.jp/en/jp/JVN37288228/index.htmlThird Party Advisory
https://www.au.com/information/notice_mobile/service/2018-002/Patch, Vendor Advisory
https://www.nttdocomo.co.jp/info/notice/page/180927_00.htmlPatch, Vendor Advisory
https://www.softbank.jp/mobile/info/personal/news/service/20180927a/Patch, Vendor Advisory
http://jvn.jp/en/jp/JVN37288228/index.htmlThird Party Advisory
https://www.au.com/information/notice_mobile/service/2018-002/Patch, Vendor Advisory
https://www.nttdocomo.co.jp/info/notice/page/180927_00.htmlPatch, Vendor Advisory
https://www.softbank.jp/mobile/info/personal/news/service/20180927a/Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.