PT-2017-6698 · Google · Android

Publicado 2017-06-27 · Atualizado 2017-07-05 · CVE-2015-3840

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Android versions prior to 5.1.1

Description The issue allows local users to modify the sent and received statuses of SMS and MMS messages without having the necessary "WRITE SMS" permission. This is due to a flaw in the MessageStatusReceiver service defined in the AndroidManifest.XML file.

Recommendations For Android versions prior to 5.1.1, consider restricting access to the MessageStatusReceiver service until a patch is available. As a temporary workaround, review and limit local user permissions to prevent unauthorized modification of message statuses.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2015-3840

Produtos afetados

Android

Referências · 4

• 🔥 http://blog.trendmicro.com/trendlabs-security-intelligence/two-new-android-bugs-mess-up-messaging-may-lead-to-multiple-send-charges · Exploit
• https://huntcve.github.io/2017/02/13/cveupdate · Nota
• http://blog.trendmicro.com/trendlabs-security-intelligence/os-x-zero-days-on-the-rise-a-2015-midyear-review-on-advanced-attack-surfaces · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-3840 · Nota de Segurança