Man-in-the-middle Vulnerability in Microsoft Outlook for Android
CVE-2014-5239

Currently unrated

Key Information:

Vendor: Microsoft
Status: Outlook.com
Vendor: CVE Published:; 14 August 2014

What is CVE-2014-5239?

The Microsoft Outlook.com application for Android versions before 7.8.2.12.49.7090 fails to properly verify X.509 certificates from SSL servers. This oversight enables man-in-the-middle attackers to spoof legitimate servers and potentially gain access to sensitive user data by employing specially crafted certificates. Users of the affected version are at risk of exposing their information to unauthorized parties if they connect to compromised networks.

References

http://www.securitytracker.com/id/1030733

vdb-entryx_refsource_SECTRACK

http://jvn.jp/en/jp/JVN72950786/index.html

third-party-advisoryx_refsource_JVN

http://jvndb.jvn.jp/jvndb/JVNDB-2014-000086

third-party-advisoryx_refsource_JVNDB

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Aug 14, 2014
Vulnerability Reserved
Aug 13, 2014

CVE-2014-5239 Data

JSON