PT-2017-19120 · Mozilla+3 · Firefox Os+3

Publicado 2017-12-05 · Atualizado 2017-12-15 · CVE-2017-9700

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Android for MSM (affected versions not specified) Firefox OS for MSM (affected versions not specified) QRD Android (affected versions not specified)

Description A buffer overwrite issue is present in the fw name store function when an image name of 64 characters is used, potentially allowing for unauthorized access or code execution. This issue affects Android releases from CAF that utilize the Linux kernel.

Recommendations For Android for MSM, update the fw name store function to properly handle image names of 64 characters or more. For Firefox OS for MSM, restrict the length of image names to prevent buffer overwrites in the fw name store function. For QRD Android, consider disabling the fw name store function until a proper fix is implemented to prevent buffer overwrites. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-9700

Produtos afetados

Android

Firefox Os

Linux Kernel

Qrd Android

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2017-9700 · Nota de Segurança
• https://source.android.com/security/bulletin/pixel/2017-12-01 · Aviso do Fabricante