CVEvulnerability
CVE-2015-9232
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-09-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.3 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 2.6 LOW — AV:N/AC:H/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-345
Description
The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Also, the Good Dynamic application activation process does not attempt to detect malicious activation attempts involving modified names beginning with a com.good.gdgma substring. Consequently, an attacker could obtain access to intranet data. This issue is only relevant in cases where the user has already downloaded a malicious Android application.
Affected configurations
• good good for enterprise 3.0.0.415
Related
Weakness · CWE (1)
- CWE-345 Insufficient Verification of Data Authenticity weakness
References
- http://www.securityfocus.com/archive/1/536543 Exploit, Mitigation, Third Party Advisory, VDB Entry
- https://community.blackberry.com/community/blogs/blog/2015/10/02/what-you-need-to-know-modzero-insecure-application-coupling Third Party Advisory
- https://www.modzero.ch/advisories/MZ-15-03-GOOD-Auth-Delegation.txt Exploit, Mitigation, Third Party Advisory
- http://www.securityfocus.com/archive/1/536543 Exploit, Mitigation, Third Party Advisory, VDB Entry
- https://community.blackberry.com/community/blogs/blog/2015/10/02/what-you-need-to-know-modzero-insecure-application-coupling Third Party Advisory
- https://www.modzero.ch/advisories/MZ-15-03-GOOD-Auth-Delegation.txt Exploit, Mitigation, Third Party Advisory