PT-2016-7162 · Google · Android

Publicado 2016-12-23 · Atualizado 2016-12-28 · CVE-2016-6910

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions prior to the fixed version are affected, specifically on Samsung Galaxy S6 Edge devices, including versions 5.0.2, 5.1.1, and 6.0.1.

Description The issue allows an unprivileged third-party app to obtain the text of the user's notifications, which can contain personal data. This is possible because a non-existent notification listener vulnerability gives a non-existent app the ability to read notifications from the device. A third-party app can exploit this by using the package name com.samsung.android.app.portalservicewidget.

Recommendations For Android 5.0.2, consider restricting access to the notification system until a patch is available. For Android 5.1.1 and 6.0.1, avoid using the package name com.samsung.android.app.portalservicewidget in third-party apps to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-6910

Produtos afetados

Android

Referências · 4

• http://kryptowire.com/disclosures/CVE-2016-6910/Factory_Resets_and_Obtaining_Notifications_on_Samsung_Android_Devices.pdf · Nota
• https://osv.dev/vulnerability/CVE-2016-6910 · Aviso do Fabricante
• http://securityfocus.com/bid/95092 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-6910 · Nota de Segurança