CVE-2014-6691: Medium severity ucweb uc browser vulnerability
The UC Browser HD (aka com.uc.browser.hd) application 3.3.1.469 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of UC Browser HD for Android version 3.3.1.469 are exposed when the application connects to SSL servers. The affected Android package is com.uc.browser.hd.
What does an attacker need to exploit it?
An attacker needs a man-in-the-middle position on the network path between the application and the intended SSL server, and must present a crafted certificate. No authentication is required according to the supplied vector.
What could an attacker achieve?
A successful attacker can spoof SSL servers and obtain sensitive information handled by the application. The supplied impact vector also indicates potential effects on confidentiality, integrity, and availability.