CVE-2015-5655

Vulnerability

Adways Party Track SDK for iOS prior to version 1.6.6 does not verify X.509 certificates from SSL servers during HTTPS communications. This flaw affects both communications made by the SDK and those made by applications using NSURLConnection as reported by the developer [1][2]. Applications built with the vulnerable SDK are affected.

Exploitation

An attacker capable of performing a man-in-the-middle attack on the network (e.g., on a shared Wi-Fi or compromised router) can present a crafted certificate to the application. The SDK, lacking proper certificate validation, accepts the spoofed certificate, allowing the attacker to intercept the encrypted SSL/TLS session [2]. No authentication or user interaction beyond being on the same network path is required.

Impact

Successful exploitation allows the attacker to eavesdrop on or alter encrypted communications between the application and legitimate servers [1][2]. This compromises the confidentiality and integrity of data transmitted by the SDK or the host application, such as user tracking information or other sensitive data.

Mitigation

Adways released SDK version 1.6.6 to fix the certificate validation issue. Developers must update to this version and rebuild their applications. The vendor's site (https://partytrack.it) provides the updated SDK and release notes [1][3]. No workarounds are available for prior versions.