Avira Mobile Security iOS Application - Cleartext Credentials Vulnerability

2015-09-14T00:00:00
ID SECURITYVULNS:DOC:32507
Type securityvulns
Reporter Securityvulns
Modified 2015-09-14T00:00:00

Description

Avira Mobile Security iOS Application - Cleartext Credentials Vulnerability

http://www.info-sec.ca/advisories/Avira-Mobile-Security.html

Overview

"Avira Mobile Security is the ideal tool to recover a lost phone and ensure that your email has not been compromised."

"Avira Mobile Security helps reunite you with your missing iPhone by pinpointing its location on a map, triggering a loud yell and calling it from the Avira Dashboard."

(https://itunes.apple.com/us/app/avira-mobile-security/id692893556)

Issue

The Avira Mobile Security iOS application (version 1.5.7 and below) sends login information via an HTTP POST, with the password insufficiently protected by the insecure MD5 algorithm.

Impact

An attacker who can sniff network traffic could capture usernames, passwords and sensitive information without the user's knowledge.

Timeline

July 17, 2015 - Notified Avira via security@avira.com July 20, 2015 - Avira responded that they will investigate the vulnerability and provide a response July 26, 2015 - Asked for an update on the investigation July 27, 2015 - Avira confirmed the vulnerability and advised that they are working on an update August 14, 2015 - Asked for a timeline to release the new version August 18, 2015 - Avira said the vulnerability has been fixed and is being tested prior to deployment September 3, 2015 - Avira released version 1.5.11 which resolves this vulnerability

Solution

Upgrade to version 1.5.11 or later