PT-2014-2405 · Google · Android

Publicado 2014-03-03 · Atualizado 2020-07-28 · CVE-2012-6636

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Android API versions prior to 17

Description The issue allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection API within crafted JavaScript code that is loaded into the WebView component in an application targeted to API level 16 or earlier.

Recommendations For Android API versions prior to 17, consider restricting the use of the WebView.addJavascriptInterface method until a patch is available. As a temporary workaround, avoid using the WebView component to load crafted JavaScript code.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-6636

Produtos afetados

Android

Referências · 18

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/android/browser/webview_addjavascriptinterface.rb · Exploit
• 🔥 https://exploit-db.com/exploits/41675 · Exploit
• 🔥 http://cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf · Exploit
• http://openwall.com/lists/oss-security/2014/02/07/9 · Nota
• http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt · Nota
• https://cve.org/CVERecord?id=CVE-2012-6636 · Nota de Segurança
• http://jvn.jp/en/jp/JVN62161191/index.html · Nota
• http://developer.android.com/reference/android/os/Build.VERSION_CODES.html#JELLY_BEAN_MR1 · Nota
• http://developer.android.com/reference/android/webkit/WebView.html#addJavascriptInterface%28java.lang.Object%2C%20java.lang.String%29 · Nota
• http://openwall.com/lists/oss-security/2014/02/07 · Nota
• https://t.me/cvenotify/904 · Publicação no Telegram
• https://support.lenovo.com/us/en/product_security/len_6421 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-6636 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-6636 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2012-6636 · Aviso do Fabricante