PT-2014-2851 · Google · Android

Tamami Eguchi · Publicado 2014-03-03 · Atualizado 2014-03-10 · CVE-2013-4710

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions 3.0 through 4.1.x

Description The issue is related to the improper implementation of the WebView class, which allows remote attackers to execute arbitrary methods of Java objects or cause a denial of service (reboot) via a crafted web page. This can be achieved by using the WebView.addJavascriptInterface method.

Recommendations For Android versions 3.0 through 4.1.x, consider disabling the WebView.addJavascriptInterface method as a temporary workaround until a patch is available. Restrict access to the WebView class to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-4710

Produtos afetados

Android

Referências · 14

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/android/browser/webview_addjavascriptinterface.rb · Exploit
• 🔥 https://exploit-db.com/exploits/41675 · Exploit
• 🔥 https://exploit-db.com/exploits/31519 · Exploit
• http://jvn.jp/en/jp/JVN53768697/995417/index.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4710 · Nota de Segurança
• http://jvn.jp/en/jp/JVN53768697/113349/index.html · Nota
• http://jvn.jp/en/jp/JVN53768697/index.html · Nota
• http://jvn.jp/en/jp/JVN53768697/995293/index.html · Nota
• http://jvn.jp/en/jp/JVN53768697/397327/index.html · Nota
• http://jvn.jp/en/jp/JVN53768697/995312/index.html · Nota
• http://emobile.jp/products/sh/a01sh/systemsoftware.html · Nota
• http://jvndb.jvn.jp/jvndb/JVNDB-2013-000111 · Nota
• http://openwall.com/lists/oss-security/2014/02/18/11 · Nota
• http://50.56.33.56/blog/?p=314 · Nota