JVN#27137002: IIJ SmartKey App for Android vulnerable to authentication bypass

IIJ SmartKey App for Android provided by Internet Initiative Japan Inc. is an application that enables two-step authentication (two-factor authentication) for a website from an Android device. IIJ SmartKey App for Android contains an authentication bypass vulnerability (CWE-287).

Impact

An attacker may be able to obtain one-time password.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.
The developer recommends that users should update the application to 2.1.1 or later version immediately.

Apply a Workaround
The following workaround may mitigate the impact of this vulnerability.

• Use the screen lock of Android OS standard function

Products Affected

• IIJ SmartKey App for Android version 2.1.0 and earlier