PT-2019-13540 · Bluestacks · Bluestacks

Publicado 2019-09-24 · Atualizado 2021-09-08 · CVE-2019-14220

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BlueStacks versions 4.110 and below on macOS BlueStacks versions 4.120 and below on Windows

Description The issue concerns a local arbitrary file read through a system service call. It affects the method that runs with System admin privilege, allowing it to return the content of a file given the file name as a parameter. A malicious app can exploit this to read the content of any system file it is not authorized to read.

Recommendations For BlueStacks versions 4.110 and below on macOS, consider restricting access to system service calls until a patch is available. For BlueStacks versions 4.120 and below on Windows, consider disabling the affected method to prevent unauthorized file reads. As a temporary workaround, avoid using the affected system service call with sensitive file names until the issue is resolved.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2019-14220

Produtos afetados

Bluestacks

Referências · 4

• https://support.bluestacks.com/hc/en-us/articles/360033484132-BlueStacks-fails-to-restrict-access-permissions · Aviso do Fabricante
• https://support.bluestacks.com/hc/en-us/articles/360021469391-Release-Notes · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-14220 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-14220 · Nota de Segurança