PT-2014-4344 · Drinkedin+1 · Drinkedin Barfinder+1

Publicado 2014-03-03 · Atualizado 2014-03-07 · CVE-2014-1887

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions DrinkedIn BarFinder application for Android versions with Adobe PhoneGap 2.9.0 or earlier

Description The issue allows remote attackers to execute arbitrary JavaScript code and obtain sensitive fine-geolocation information by leveraging control over certain adult sites. This can be achieved by exploiting the vulnerability in the DrinkedIn BarFinder application when it uses Adobe PhoneGap 2.9.0 or earlier.

Recommendations For DrinkedIn BarFinder application for Android versions with Adobe PhoneGap 2.9.0 or earlier, consider updating Adobe PhoneGap to a version later than 2.9.0 to mitigate the risk of arbitrary JavaScript code execution. As a temporary workaround, restrict access to the application's geolocation features until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-1887

Produtos afetados

Phonegap

Drinkedin Barfinder

Referências · 4

• 🔥 http://cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf · Exploit
• http://internetsociety.org/ndss2014/programme#session3 · Nota
• http://openwall.com/lists/oss-security/2014/02/07/9 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-1887 · Nota de Segurança