what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Apple Music Android Application Man-In-The-Middle

Apple Music Android Application Man-In-The-Middle
Posted Apr 6, 2017
Authored by David Coomber

The Apple Music Android application (version 1.2.1 and below) does not validate the SSL certificate received when connecting to the mobile application login and payment servers.

tags | advisory
systems | apple
advisories | CVE-2017-2387
SHA-256 | 1422d48bcd8eed64fc465a014de8e359bdf5f4adb5d983d4dc5bc3f09063b2b3

Apple Music Android Application Man-In-The-Middle

Change Mirror Download
Apple Music Android Application - MITM SSL Certificate Vulnerability
(CVE-2017-2387)
--
http://www.info-sec.ca/advisories/Apple-Music.html

Overview

"Listen to all the music you want, anytime."

(https://play.google.com/store/apps/details?id=com.apple.android.music)

Issue

The Apple Music Android application (version 1.2.1 and below), does
not validate the SSL certificates it receives when connecting to the
mobile application login and payment servers.

Impact

An attacker who can perform a man in the middle attack may present
bogus SSL certificates which the application will accept silently.
Sensitive information could be captured by an attacker without the
user's knowledge.

Timeline

August 5, 2016 - Notified Apple via product-security@apple.com
August 5, 2016 - Apple sent an auto acknowledgment
August 16, 2016 - Apple responded stating that they are investigating
October 5, 2016 - Apple confirmed the vulnerability
January 18, 2017 - Asked for a status update
January 20, 2017 - Apple responded stating that they are still working
on the issue
April 4, 2017 - Apple released version 2.0.0 which resolves this vulnerability

Solution

Upgrade to version 2.0.0 or later

https://support.apple.com/en-us/HT207605
https://support.apple.com/en-us/HT201222

CVE-ID:

CVE-2017-2387
Login or Register to add favorites

File Archive:

June 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    0 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    18 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    57 Files
  • 7
    Jun 7th
    6 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    12 Files
  • 11
    Jun 11th
    27 Files
  • 12
    Jun 12th
    38 Files
  • 13
    Jun 13th
    16 Files
  • 14
    Jun 14th
    14 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close