PT-2012-4410 · Google · Android

Glenn Ten Cate · Publicado 2012-08-21 · Atualizado 2012-08-21 · CVE-2012-2980

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified) on T-Mobile myTouch 3G Slide, HTC Merge, Sprint EVO Shift 4G, HTC ChaCha, AT&T Status, HTC Desire Z, T-Mobile G2, T-Mobile myTouch 4G Slide, and Samsung Galaxy S

Description The onTouchEvent method implementation for Android on certain devices stores touch coordinates in the dmesg buffer. This allows remote attackers to obtain sensitive information, such as PIN numbers, telephone numbers, and text messages, via a crafted application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2012-2980

Produtos afetados

Android

Referências · 4

• http://kb.cert.org/vuls/id/MAPG-8R5LD6 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2980 · Nota de Segurança
• http://htc.com/www/help/app-security-fix · Nota
• http://kb.cert.org/vuls/id/251635 · Nota