Vulnerability Name:

CVE-2016-6231 (CCN-115672)

Assigned:2016-08-01
Published:2016-08-01
Updated:2018-10-09
Summary:Kaspersky Safe Browser iOS before 1.7.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information via a crafted certificate.
CVSS v3 Severity:5.9 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
5.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
4.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
3.8 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-200
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2016-6231

Source: CCN
Type: BugTraq Mailing List, Mon, 1 Aug 2016 08:25:25 -0400
Kaspersky Safe Browser iOS Application - MITM SSL Certificate Vulnerability (CVE-2016-6231)

Source: FULLDISC
Type: Third Party Advisory, VDB Entry
20160805 Kaspersky Safe Browser iOS Application - MITM SSL Certificate Vulnerability (CVE-2016-6231)

Source: MISC
Type: Third Party Advisory
http://www.info-sec.ca/advisories/Kaspersky-Safe-Browser.html

Source: BUGTRAQ
Type: UNKNOWN
20160801 Kaspersky Safe Browser iOS Application - MITM SSL Certificate Vulnerability (CVE-2016-6231)

Source: BID
Type: UNKNOWN
92200

Source: CCN
Type: BID-92200
Kaspersky Safe Browser CVE-2016-6231 SSL Certificate Validation Security Bypass Vulnerability

Source: XF
Type: UNKNOWN
kaspersky-safebrowser-cve20166231-mitm(115672)

Source: CCN
Type: Apple Web site
Kaspersky Safe Browser: Fast Free on the App Store

Source: CONFIRM
Type: Third Party Advisory
https://support.kaspersky.com/vulnerability.aspx?el=12430#280716

Vulnerable Configuration:Configuration 1:
  • cpe:/a:kaspersky:safe_browser:*:*:*:*:*:iphone_os:*:* (Version <= 1.6.0)

    • Configuration CCN 1:
  • cpe:/a:kaspersky:safe_browser:1.6.0::~~~iphone_os~~:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    kaspersky safe browser *
    kaspersky safe browser 1.6.0