CVE-2014-5955

Vulnerability

Atomic Fusion (com.bytesized.fusion) version 1.7 for Android does not verify X.509 certificates from SSL servers, as reported in VU#582497 [1]. This flaw allows HTTPS connections without proper certificate chain validation.

Exploitation

An attacker on the same network as the Android device can perform a man-in-the-middle (MITM) attack by presenting a crafted certificate [1]. No authentication or user interaction beyond normal app usage is required; the app accepts the fraudulent certificate silently.

Impact

Successful exploitation enables the attacker to spoof legitimate servers and obtain sensitive information transmitted by the application [1]. Depending on the app's functionality, this could include credentials or other private data; arbitrary code execution is also a possible outcome per the source [1].

Mitigation

The CERT/CC recommends not using the affected application and instead accessing the same services via a web browser [1]. No official patch from the vendor has been identified in the available references; users should uninstall or discontinue use of Atomic Fusion 1.7.