CVE Details for CVE: CVE-2014-5704
Summary
The DISH Anywhere (aka com.sm.SlingGuide.Dish) application 3.5.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
| Timestamps | |
|---|---|
| Last major update | 17-06-2016 - 02:00 |
| Published | 09-09-2014 - 10:55 |
| Last modified | 17-06-2016 - 02:00 |
CAPEC
Click the CAPEC title to display a description
-
Signature Spoofing by Key Recreation
An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
CWE
CVSS
Base
5.4
Impact
6.4
Exploitability
5.5
Access
| Vector | Complexity | Authentication |
|---|---|---|
| ADJACENT_NETWORK | MEDIUM | NONE |
Impact
| Confidentiality | Integrity | Availability |
|---|---|---|
| PARTIAL | PARTIAL | PARTIAL |
CVSS3
None