[Japanese]

JVNDB-2018-000084

LINE MUSIC for Android fails to verify SSL server certificates

Overview

LINE MUSIC for Android provided by LINE MUSIC CORPORATION fails to verify SSL server certificates (CWE-295).

LINE MUSIC CORPORATION reported this vulnerability to JPCERT/CC to notify users of respective solutions through JVN.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 4.8 (Medium) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None
CVSS V2 Severity:
Base Metrics 4.0 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: High
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: None
Affected Products


LINE MUSIC CORPORATION
  • LINE MUSIC for Android version 3.1.0 to versions prior to 3.6.5

Impact

A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication.
Solution

[Update the Application]
Update to the latest version according to the information provided by the developer.

The developer states that this vulnerability was addressed in the version 3.6.5.
Vendor Information

LINE MUSIC CORPORATION
CWE (What is CWE?)

  1. No Mapping(CWE-Other) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2018-0650
References

  1. JVN : JVN#16933564
  2. National Vulnerability Database (NVD) : CVE-2018-0650
Revision History

  • [2018/07/26]
      Web page was published
  • [2019/07/25]
      References : Content was added

Date Public2018/07/26
Date First Published2018/07/26
Date Last Updated2019/07/25