CVE-2014-6655: Medium severity exoticpetnetwork tortoise forum vulnerability

Published Sep 23, 2014

Updated

The Tortoise Forum (aka org.tortoiseforum.android.forumrunner) application 3.5.16 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Affected Software

1 affected component

Exoticpetnetwork Tortoise Forum Android=3.5.16

Event History

Sep 23, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-6655?

CVE-2014-6655 is considered a high severity vulnerability due to its potential for man-in-the-middle attacks.

How do I fix CVE-2014-6655?

To fix CVE-2014-6655, update the Tortoise Forum application to a secure version that properly verifies X.509 certificates.

What type of attack is facilitated by CVE-2014-6655?

CVE-2014-6655 facilitates man-in-the-middle attacks that can spoof SSL servers.

What version of Tortoise Forum is affected by CVE-2014-6655?

The affected version of Tortoise Forum by CVE-2014-6655 is 3.5.16 for Android.

What information can be compromised due to CVE-2014-6655?

CVE-2014-6655 allows attackers to obtain sensitive information from users through crafted certificates.