PT-2014-3197 · Koush+2 · Koush Superuser+2

Publicado 2014-03-30 · Atualizado 2014-04-03 · CVE-2013-6770

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CyanogenMod/ClockWorkMod/Koush Superuser package version 1.0.2.1

Description The issue concerns the CyanogenMod/ClockWorkMod/Koush Superuser package, which does not properly restrict the set of users who can execute /system/xbin/su with the --daemon option. This allows attackers to gain privileges by leveraging ADB shell access and a certain Linux UID, and then creating a Trojan horse script.

Recommendations For CyanogenMod/ClockWorkMod/Koush Superuser package version 1.0.2.1, consider restricting access to the /system/xbin/su executable to minimize the risk of exploitation. As a temporary workaround, avoid using the --daemon option with the su command until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-6770

Produtos afetados

Clockworkmod

Cyanogenmod

Koush Superuser

Referências · 2

• 🔥 http://securityfocus.com/archive/1/529795 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-6770 · Nota de Segurança