PT-2017-7290 · Samsung · Samsung S6 Edge

Publicado 2017-06-07 · Atualizado 2017-06-14 · CVE-2015-7888

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Samsung S6 Edge version G925VVRU1AOE2

Description A directory traversal issue exists in the WifiHs20UtilityService, allowing remote attackers to overwrite or create arbitrary files as the system-level user. This is achieved by including a .. (dot dot) in the name of a file, compressing it into a zipped file named cred.zip, and downloading it to /sdcard/Download.

Recommendations For Samsung S6 Edge version G925VVRU1AOE2, as a temporary workaround, consider restricting access to the WifiHs20UtilityService until a patch is available. Avoid downloading zipped files from untrusted sources to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2015-7888

Produtos afetados

Samsung S6 Edge

Referências · 4

• http://packetstormsecurity.com/files/134104/Samsung-WifiHs20UtilityService-Path-Traversal.html · Nota
• https://bugs.chromium.org/p/project-zero/issues/detail?id=489&q=samsung&redir=1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7888 · Nota de Segurança
• http://securityfocus.com/bid/77338 · Nota