Is CVE-2016-1920 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-1920 being exploited in the wild.

How severe is CVE-2016-1920?

Medium severity, with a CVSS score of 5.5, published 27 January 2017.

Is there a fix for CVE-2016-1920?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2016-1920 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2016-1920?

Check whether you run Samsung Knox. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-1920: Samsung KNOX shared certificate man-in-the-middle vulnerability

CVE-2016-1920 · Severity: medium · CVSS 5.5 · Published 2017-01-27

Samsung KNOX is a security framework designed to provide a secure environment for mobile devices. A vulnerability in version 1.0.0 allows a local user to intercept and modify encrypted traffic by exploiting how the system handles security certificates. This could allow an attacker to perform man-in-the-middle attacks, potentially compromising the integrity of data transmitted by the device.

Technologies: Samsung Knox. Vendors: Samsung.

Quick answers

Is CVE-2016-1920 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-1920 being exploited in the wild.
How severe is CVE-2016-1920?: Medium severity, with a CVSS score of 5.5, published 27 January 2017.
Which products and versions are affected?: Samsung KNOX 1.0.0.
Is there a fix for CVE-2016-1920?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-1920 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2016-1920?: Check whether you run Samsung Knox. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Samsung KNOX 1.0.0 suffers from an improper access control vulnerability (CWE-284) due to the use of a shared certificate store on the Android platform. A local attacker can exploit this by installing a malicious certificate and initiating a VPN service to intercept traffic. This configuration allows for man-in-the-middle (MitM) attacks against the secure container. The attack requires user interaction to install the certificate but can result in a high impact on data integrity. This issue is specific to the early implementation of the KNOX framework on Android.

Affected products

Samsung KNOX 1.0.0

Timeline

2017-01-27: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.