JVN#43105011: Android vulnerability where an incorrect SSL certificate is displayed

Android OS contains a vulnerability where a SSL certificate from an outside site is displayed when a user attempts to display a SSL certificate from a site that reads in contents from an outside site.

Impact

An attacker may trick the user into believing the site being visited is safe, which may lead to phishing attacks.

Solution

For Mobile Device Developers
Apply the update according to the information provided by Google.

For Mobile Device Users
For more information, please refer to the “Vendor Status” below.

This issue has been resolved in Android OS 2.2.

Products Affected

• Android OS versions prior to 2.2