Unrated severityNVD Advisory· Published Oct 24, 2012· Updated Jun 16, 2026
CVE-2012-5456
CVE-2012-5456
Description
The Zoner AntiVirus Free application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, as demonstrated by a server used for updating virus signature files.
Affected products
3cpe:2.3:a:zoner:zoner_antivirus_free:1.7.0:-:*:*:*:android:*:*+ 2 more
- cpe:2.3:a:zoner:zoner_antivirus_free:1.7.0:-:*:*:*:android:*:*
- cpe:2.3:a:zoner:zoner_antivirus_free:-:-:*:*:*:android:*:*
- (no CPE)
Patches
Vulnerability mechanics
References
3- www.securityfocus.com/bid/56292nvdThird Party AdvisoryVDB Entry
- exchange.xforce.ibmcloud.com/vulnerabilities/79591nvdThird Party AdvisoryVDB Entry
- www2.dcsec.uni-hannover.de/files/android/p50-fahl.pdfnvdBroken Link
News mentions
0No linked articles in our index yet.