CVE-2014-3908

CVE-2014-3908 affects the Kindle App for Android prior to version 4.5.0, which does not verify X.509 certificates from SSL servers. This insecure TLS validation can allow MITM attackers to spoof servers and obtain sensitive information via forged certificates. Public references from NVD/JVN confi...

Kindle App for Android fails to verify SSL server certificates

Overview Kindle App for Android fails to verify SSL server certificates. Hiroshi Tokumaru of HASH Consulting Corp. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A man-in-the-middle attack may allow an...

JVN#17637243: Kindle App for Android fails to verify SSL server certificates

Kindle App for Android fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Software Update to the latest version according to the information provided by the developer. Products Affected...