Cryptographic issues in Google Android - CVE-2010-4832
Published: May 14, 2014 / Updated: August 10, 2020
Vulnerability identifier: #VU41687
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2010-4832
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Google
Affected software:
Google Android
Google Android
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to manipulate data.
Android OS before 2.2 does not display the correct SSL certificate in certain cases, which might allow remote attackers to spoof trusted web sites via a web page containing references to external sources in which (1) the certificate of the last loaded resource is checked, instead of for the main page, or (2) later certificates are not checked when the HTTPS connection is reused.
How to mitigate CVE-2010-4832
Install update from vendor's website.
Sources
- http://android.git.kernel.org/?p=platform/frameworks/base.git;a=commit;h=dba8cb76371960457e91b31fa396478f809a5a34
- http://jvn.jp/en/jp/JVN43105011/index.html
- http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000053.html
- https://gitorious.org/atrix-aosp/frameworks_base/commit/dba8cb76371960457e91b31fa396478f809a5a34