PT-2018-12868 · Google+1 · Android+1

Publicado 2018-12-28 · Atualizado 2019-02-07 · CVE-2018-15001

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys

Description The issue allows any app co-located on the device to initiate the writing of the logcat log, bluetooth log, and kernel log to external storage through the com.vivo.bsptest.BSPTestActivity component. When logging is enabled, a notification appears in the status bar. Although the user can cancel the logging, it can be re-enabled since the app with the package name com.vivo.bsptest cannot be disabled. An app co-located on the device can initiate the writing of these logs, but it requires the READ EXTERNAL STORAGE permission to access the log files.

Recommendations For the Vivo V7 Android device with the specified build fingerprint, consider disabling the com.vivo.bsptest.BSPTestActivity component as a temporary workaround to prevent unauthorized log writing. Restrict access to the external storage to minimize the risk of log file exploitation. Avoid using the com.vivo.bsptest app until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2018-15001

Produtos afetados

Android

Vivo V7

Referências · 4

• 🔥 https://kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-15001 · Nota de Segurança
• https://kryptowire.com/portal/android-firmware-defcon-2018 · Nota
• https://osv.dev/vulnerability/CVE-2018-15001 · Aviso do Fabricante