bugtraq - Avira Mobile Security iOS Application - Cleartext Credentials Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAHmS9PJ4eTYQWH65e1UHf7088oXhsRy=Xs-0oS+-c+4dnn0Nrw@mail.gmail.com>
Date: Fri, 4 Sep 2015 15:03:10 -0400
From: David Coomber <davidcoomber.infosec@...il.com>
To: fulldisclosure@...lists.org, bugtraq@...urityfocus.com, vuln@...unia.com,
  cert@...t.org
Subject: Avira Mobile Security iOS Application - Cleartext Credentials Vulnerability

Avira Mobile Security iOS Application - Cleartext Credentials Vulnerability
--
http://www.info-sec.ca/advisories/Avira-Mobile-Security.html

Overview

"Avira Mobile Security is the ideal tool to recover a lost phone and
ensure that your email has not been compromised."

"Avira Mobile Security helps reunite you with your missing iPhone by
pinpointing its location on a map, triggering a loud yell and calling
it from the Avira Dashboard."

(https://itunes.apple.com/us/app/avira-mobile-security/id692893556)

Issue

The Avira Mobile Security iOS application (version 1.5.7 and below)
sends login information via an HTTP POST, with the password
insufficiently protected by the insecure MD5 algorithm.

Impact

An attacker who can sniff network traffic could capture usernames,
passwords and sensitive information without the user's knowledge.

Timeline

July 17, 2015 - Notified Avira via security@...ra.com
July 20, 2015 - Avira responded that they will investigate the
vulnerability and provide a response
July 26, 2015 - Asked for an update on the investigation
July 27, 2015 - Avira confirmed the vulnerability and advised that
they are working on an update
August 14, 2015 - Asked for a timeline to release the new version
August 18, 2015 - Avira said the vulnerability has been fixed and is
being tested prior to deployment
September 3, 2015 - Avira released version 1.5.11 which resolves this
vulnerability

Solution

Upgrade to version 1.5.11 or later