PT-2014-3029 · Google · Android

Publicado 2014-08-31 · Atualizado 2014-09-02 · CVE-2013-6124

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Baixa

Vetor base

AV:L/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Android versions 4.1.x through 4.4.x

Description The issue allows local users to modify file metadata via a symlink attack on a file accessed by a (1) chown or (2) chmod command. This can be demonstrated by changing the permissions of an arbitrary file via an attack on the sensor-settings file.

Recommendations For Android versions 4.1.x through 4.4.x, consider restricting access to the sensor-settings file to prevent symlink attacks until a patch is available. As a temporary workaround, avoid using the chown or chmod commands on files that can be accessed by local users.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2013-6124

Produtos afetados

Android

Referências · 2

• https://codeaurora.org/projects/security-advisories/insecure-owner-permission-changes-init-shell-scripts-cve-2013-6124 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-6124 · Nota de Segurança