PT-2016-1806 · Google · Android

Heisecode + 1 · Publicado 2016-04-18 · Atualizado 2016-04-25 · CVE-2016-2419

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions prior to 2016-04-01

Description The issue concerns a component of the Android operating system, specifically the media/libmedia/IDrm.cpp in the mediaserver. It does not properly initialize a certain key-request data structure. This can be exploited by a remote attacker to obtain sensitive information from process memory, thereby bypassing an unspecified protection mechanism. The exploitation can be achieved via unspecified vectors, potentially allowing attackers to gain Signature or SignatureOrSystem access.

Recommendations For Android versions prior to 2016-04-01, update the operating system to a version released after 2016-04-01 to resolve the issue. As a temporary workaround, consider restricting access to sensitive information and limiting the use of the mediaserver to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2016-01139

CVE-2016-2419

Produtos afetados

Android

Referências · 8

• http://source.android.com/security/bulletin/2016-04-02.html · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2016-2419 · Nota de Segurança
• https://bdu.fstec.ru/vul/2016-01139 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-2419 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-2419 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-2419 · Nota de Segurança
• https://android.googlesource.com/platform/frameworks/av/+/5a856f2092f7086aa0fea9ae06b9255befcdcd34 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2419 · Aviso do Fabricante