PT-2017-2935 · Kaspersky · Kaspersky Internet Security For Android

Publicado 2017-08-09 · Atualizado 2021-06-17 · CVE-2017-12816

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kaspersky Internet Security for Android version 11.12.4.1622

Description The issue is related to insufficient access control in Kaspersky Internet Security for Android, which can be exploited by a remote attacker to gain unauthorized access to the product's functionality using the Android Inter-Process Communication (IPC) system. This could potentially allow a malware application to access the product's features without proper authorization.

Recommendations For Kaspersky Internet Security for Android version 11.12.4.1622, consider restricting access to the application's exported activities to minimize the risk of exploitation until a patch is available. As a temporary workaround, review and limit the use of Android IPC to reduce the potential for unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Enumeração de Fraquezas

CWE-732

CWE-264

Identificadores relacionados

BDU:2017-02260

CVE-2017-12816

Produtos afetados

Kaspersky Internet Security For Android

Referências · 5

• https://support.kaspersky.com/vulnerability.aspx?el=12430#090817 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12816 · Nota de Segurança
• http://securityfocus.com/bid/100505 · Nota
• https://bdu.fstec.ru/vul/2017-02260 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-12816 · Aviso do Fabricante