PT-2015-3956 · Google · Android

Publicado 2015-03-12 · Atualizado 2020-02-26 · CVE-2014-7914

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Android versions prior to 5.1

Description The issue allows user-assisted remote attackers to bypass intended access restrictions via crafted Bluetooth packets after the tapping of a crafted NFC tag. This is due to the improper enforcement of the temporary nature of a Bluetooth pairing in the btif/src/btif dm.c file.

Recommendations For Android versions prior to 5.1, update to version 5.1 or later to resolve the issue. As a temporary workaround, consider restricting Bluetooth pairing to trusted devices and avoiding the use of NFC tags from untrusted sources.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2014-7914

ZDI-15-092

Produtos afetados

Android

Referências · 4

• https://t.me/cvenotify/1129 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2014-7914 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-15-092 · Nota de Segurança
• https://android.googlesource.com/platform/external/bluetooth/bluedroid/+/0360aa7c418152a3e5e335a065ac3629cbb09559 · Aviso do Fabricante