what you don't know can hurt you

Good Mobile Access Man-In-The-Middle

Good Mobile Access Man-In-The-Middle
Posted Nov 13, 2012
Authored by Thierry Zoller

GMA aka Good Mobile Access, part of the Good For Enterprise application, failed to validate server authenticity in versions prior to 2.0.2.

tags | advisory
MD5 | 246f26b78da591033bed7bad920b79cf

Good Mobile Access Man-In-The-Middle

Change Mirror Download

RANT
----
The world of mobile applications appear to have become one where vulnerability
disclosure and awareness are not necessary. Until there are fully automated
updates and refusal of service for outdated applications I see the
need for disclosure.

Who will start monitoring "Appstores" updates for signs of vulnerabilities ?

Note to vulnerability researches : GMA appears to be a nice fuzzing target and
in general for browser security assessments.(see below on rationale)

Description
-----------
GMA is known as "Good™ Mobile Access" and part of "Good for Enteprise"
"The secure browser is integrated into the Good for Enterprise application, delivering a safe,
intelligent user experience. Employees can launch Good’s browser directly from the Good launcher bar,
as well as through links included in emails. Links to public websites will automatically launch
the native browser."

Title : GOOD for Enterprise GMA below 2.0.2 vulnerable to MITM
URL : http://www-staging.good.com/products/good-mobile-access.php
Root Cause: GMA failed to validate server authenticity when connecting through HTTPS

I spotted what appears to be an undisclosed vulnerability in an
enterprise mobile device management system.

https://itunes.apple.com/us/app/good-for-enterprise/id333202351?mt=8

Excerpt from above :

What's New in Version 2.0.2
This release addresses the following
[..]- GMA now validates server authenticity when connecting through HTTPS.
[..]

This would imply GMA to have been vulnerable to MITM prior to version 2.0.2

Disclosure Timeline :
=====================
- GOOD disclosed over iTunes on the 02.08.2012

--
http://blog.zoller.lu
Thierry Zoller



Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    34 Files
  • 2
    Jul 2nd
    15 Files
  • 3
    Jul 3rd
    9 Files
  • 4
    Jul 4th
    8 Files
  • 5
    Jul 5th
    2 Files
  • 6
    Jul 6th
    3 Files
  • 7
    Jul 7th
    1 Files
  • 8
    Jul 8th
    15 Files
  • 9
    Jul 9th
    15 Files
  • 10
    Jul 10th
    20 Files
  • 11
    Jul 11th
    17 Files
  • 12
    Jul 12th
    16 Files
  • 13
    Jul 13th
    2 Files
  • 14
    Jul 14th
    1 Files
  • 15
    Jul 15th
    20 Files
  • 16
    Jul 16th
    27 Files
  • 17
    Jul 17th
    7 Files
  • 18
    Jul 18th
    5 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close