Security Advisory: Bambuser Mobile Application

Security Advisory: Bambuser Mobile Application

1. Advisory Title: Bambuser Mobile Application Information Disclosure Vulnerability

2. Internal ID: STRATSEC-2012-002

3. External ID: CVE Pending

4. Date discovered: August 10, 2012

5. Date reported: August 10, 2012

6. Date published: October 3, 2012

7. Current status: Vendor fix is in place

8. Discovered by: Beau Woods, Stratigos Security

9. Vendor: Bambuser (bambuser.com)

10. Affected product: Bambuser mobile application

11. Platform: iOS (confirmed); likely other versions (unconfirmed)

12. Vulnerable Version: 1.9.3 (confirmed); likely previous versions (unconfirmed)

13. Severity: 4.7 (CVSS v2)

Stratigos Security became aware of a vulnerability in the Bambuser mobile application and reported the issue to Bambuser on August 10, 2012. Bambuser quickly responded, provided estimated timeline for the fix and notified Stratigos Security when the updated version was published. Stratigos Security has confirmed that this vulnerability has been fixed in the updated version.

The formal advisory is published here: Security Advisory STRAT-2012-002 Bambuser Mobile Application Information Disclosure Vulnerability

#securityadvisories #mobilesecurity #passworddisclosure #Bambuser #iPhone #Apple #credentialdisclosure #videostreamingapp #videostreaming #informationdisclosure #mobileapplicationsecurity #Security #CVSS #iOS