Summary
=======
HelpBridge application for Android (version 1.0.2) stores sensitive information in cleartext within the SQLite database.
CVE number: Not Assigned
Impact: Medium
Vendor homepage: http://www.microsoft.com/
Vendor notified: 12/13/2012
Vendor fixed: 4/15/2013
Credit: Christopher Emerson of White Oak Security
(https://www.whiteoaksecurity.com/)
Affected Products
=================
Confirmed in HelpBridge application for Android (version 1.0.2). Other versions may also be affected.
Details
=======
When a user successfully signs into the application, the user’s username and password are stored in cleartext within the webview.db > password table.
Impact
======
A user’s username and password could be accessed by any other application with permissions to read that table. An attacker could use those credentials to impersonate the user and potentially access the valid user’s content and purchase additional content with any saved payment devices.
The impact could be much greater if the user’s account is tied to other Microsoft services such as Skype, web mail, etc…
Furthermore, the cleartext credentials will be stored on the user’s mobile phone which makes them more easily accessible to an attacker with access to the device. This significantly lowers the difficulty of exploitation.
Solution
========
The vendor has release an application update which removes the users password from webview.db.
Disclosure Timeline
==============
December 13, 2012: Disclosed to vendor (Microsoft Security Response Center).
January 4, 2013: Vendor’s initial response.
May 2, 2013: Vendor stated a fix was implemented 4/15/2013.
May 8, 2013: Disclosed vulnerability publicly.