lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 8 Jan 2015 20:53:59 +0000
From: Cláudio André <ca@...egrity.pt>
To: fulldisclosure@...lists.org
Subject: [FD] Good for Enterprise Android HTML Injection (CVE-2014-4925)

https://labs.integrity.pt/articles/good-for-enterprise-android-html-injection-cve-2014-4925/

1. Vulnerability Properties
Title: HTML Injection in Good for Enterprise Android
CVE ID: CVE-2014-4925
CVSSv2 Base Score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
Vendor: Good Technology (http://www1.good.com/)
Products: Good for Enterprise Android (possibly others)
Advisory Release Date: 8 January 2015
Advisory URL: http://labs.integrity.pt/advisories/cve-2014-4925/
Credits: Discovery and PoC by Cláudio André <ca[at]integrity.pt>

2. Vulnerability Summary
A remote attacker is able to send a crafted email with a payload that
redirects the user to a target url as soon as he opens the email.

3. Technical Details
The vulnerability can be confirmed by sending a HTML email with the
following content:

<meta http-equiv=”refresh” content=”0;URL=’http://www.maliciousurl.com’” />

Exploiting this vulnerability could allow an attacker to redirect a user to
a malicious website, allowing hooking the browser with malicious
JavaScript, launching phishing attacks, etc.

4. Vulnerable Versions
Confirmed on version 1.9.0.40, but from the vendor feedback all versions up
to 2.8.0.398 should be vulnerable.

5. Solution
Currently there is none. The vendor has classified this issue as unfixable
and a product limitation.

6. Vulnerability Timeline
16 Apr 2014 – Vulnerability reported to vendor
7 Jan 2015 – Vendor gave final feedback that the issue was not a
vulnerability and instead being a product limitation and unfixable.


-- 
Cláudio André
Security Consultant @ Integrity S.A
www.integrity.pt

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists