TrueCaller Vulnerability Allows Changing Users Details

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1047400 漏洞类型
发布时间 2012-06-02 更新时间 2012-06-02
漏洞平台 N/A CVSS评分 N/A
TrueCaller – worldwide number search and spam filter, a top iPhone
application in many countries, enables users to search half a billion phone
numbers worldwide and much more.

The application allows users to search numbers if and only if the user
enables *Enhanced Search* feature. When enabled, the user is warned that
his contacts will be shared with other users to search and his address book
is sent to TrueCaller database. This process is done by sending the
following HTTP “*cleartext*” request:


From a security point of view, this is a bad security behavior and may lead
to one of the following situations:

   - *Privacy Issues*
   - *Fake Data*
   - *Enabling Enhanced Search features without having to share user’s
   Address Book*

*Advisory Timeline*

28/Apr/2012 – First contact: Vulnerability details sent
29/Apr/2012 – Response received: Asked for more details
29/Apr/2012 – Second Contact: More details provided and cleared TrueCaller
30/Apr/2012 – Vulnerability Confirmed: TrueCaller started working on a fix
01/May/2012 – Vulnerability Fixed: Fix submitted to Apple for approval
17/May/2012 – New Version Released: Fix approved by Apple and released
01/Jun/2012  - Vulnerability Released.

Details and more information here: