CVE-2017-5915 : What You Need to Know

The Emirates NBD Bank P.J.S.C Emirates NBD KSA mobile application versions 3.10.0 through 3.10.4 (UAE) and 2.0.1 through 2.1.0 (KSA) on iOS devices have a security vulnerability that allows for man-in-the-middle attacks.

Understanding CVE-2017-5915

This CVE entry highlights a vulnerability in the Emirates NBD Bank mobile application that could compromise the security of users' sensitive information.

What is CVE-2017-5915?

The vulnerability in the Emirates NBD Bank mobile app allows attackers to conduct man-in-the-middle attacks by presenting fraudulent servers and collecting sensitive data using manipulated certificates.

The Impact of CVE-2017-5915

The security flaw in the app poses a significant risk to users as it enables attackers to intercept and manipulate data exchanged between the app and servers, potentially leading to data theft and privacy breaches.

Technical Details of CVE-2017-5915

This section delves into the technical aspects of the vulnerability.

Vulnerability Description

The Emirates NBD Bank mobile app versions 3.10.0 through 3.10.4 (UAE) and 2.0.1 through 2.1.0 (KSA) fail to validate X.509 certificates from SSL servers, creating an opportunity for man-in-the-middle attacks.

Affected Systems and Versions

Versions 3.10.0 to 3.10.4 in the UAE and 2.0.1 to 2.1.0 in KSA on iOS devices

Exploitation Mechanism

Attackers can deceive users by presenting fraudulent servers and collect sensitive information using manipulated certificates

Mitigation and Prevention

Protecting against this vulnerability requires immediate action and long-term security practices.

Immediate Steps to Take

Avoid using the affected versions of the Emirates NBD Bank mobile app
Regularly check for updates and security patches
Exercise caution while accessing sensitive information through the app

Long-Term Security Practices

Use trusted networks when accessing sensitive data
Educate users about the risks of unsecured connections

Patching and Updates

Update the mobile app to the latest secure version
Ensure SSL certificate validation is implemented correctly to prevent man-in-the-middle attacks