PT-2016-2382 · Google · Android

Publicado 2016-07-11 · Atualizado 2016-11-28 · CVE-2014-9795

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions prior to 2016-07-05

Description The issue is caused by an integer overflow in the app/aboot/aboot.c component of Qualcomm in Android, which allows attackers to bypass intended access restrictions. This can be achieved by using crafted start and size values. The exploitation of this issue may allow a remote attacker to bypass existing access restrictions using specially formed variable values.

Recommendations For Android versions prior to 2016-07-05, consider restricting access to the app/aboot/aboot.c component until a patch is available. As a temporary workaround, avoid using crafted start and size values that could trigger the integer overflow. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

BDU:2016-01773

CVE-2014-9795

Produtos afetados

Android

Referências · 9

• https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=ce2a0ea1f14298abc83729f3a095adab43342342 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-9795 · Nota de Segurança
• http://source.android.com/security/bulletin/2016-07-01.html · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2014-9795 · Nota de Segurança
• http://securityfocus.com/bid/91628 · Nota
• https://bdu.fstec.ru/vul/2016-01773 · Nota de Segurança
• https://ubuntu.com/security/CVE-2014-9795 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-9795 · Aviso do Fabricante
• https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=fc3b31f81a1c128c2bcc745564a075022cd72a2e · Nota