Texture Canada Android & iOS Applications - Unencrypted Third Party Analytics (CVE-2019-8632)
Overview
"Texture: Unlimited access to over 100 of the world's best magazines on your computer, smartphone or tablet."
(https://play.google.com/store/apps/details?id=com.nim.rogers)
(https://itunes.apple.com/ca/app/texture-canada/id649174756)
Issue
The Texture Canada Android & iOS applications (Android version 4.21.0.1, iOS version 5.11.6 and below) sends potentially sensitive information such as number of app launches, device model,
Android or iOS version and screen resolution, unencrypted to a third party site (ScorecardResearch).
Impact
An attacker who can monitor network traffic could capture potentially sensitive information about the user's device without their knowledge.
Timeline
July 10, 2018 - Attempted to notify Texture of the issue via security@texture.ca
July 10, 2018 - Attempted to notify Texture of the issue via support@texture.ca
July 12, 2018 - Provided the details of the issue to Apple via product-security@apple.com
May 9, 2019 - Published an advisory to document the issue
Solution
Upgrade to Android version 4.22.0.4 or iOS version 5.11.10 (U.S. versions are also affected but have not been tested)
https://support.apple.com/en-us/HT210110
https://support.apple.com/en-us/HT210111
https://support.apple.com/en-us/HT201222
CVE-ID:
CVE-2019-8632
Questions?
Contact Information