PT-2019-14171 · Samsung+1 · Com.Samsung.Android.Themecenter+1

Publicado 2019-11-14 · Atualizado 2020-08-24 · CVE-2019-15442

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Samsung on7xelteskt Android device with a build fingerprint of samsung/on7xelteskt/on7xelteskt:8.1.0/M1AJQ/G610SKSU2CSB1:user/release-keys com.samsung.android.themecenter app version 7.0.1.0

Description The issue allows other pre-installed apps to perform app installation via an accessible app component. This capability can be accessed by any pre-installed app on the device that can obtain signatureOrSystem permissions required by other pre-installed apps that exported their capabilities to other pre-installed apps.

Recommendations For the Samsung on7xelteskt Android device, consider restricting access to the com.samsung.android.themecenter app until a patch is available. As a temporary workaround, consider disabling the app installation capability via the accessible app component in the com.samsung.android.themecenter app. Restrict access to signatureOrSystem permissions to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2019-15442

Produtos afetados

Android

Com.Samsung.Android.Themecenter

Referências · 2

• https://kryptowire.com/android-firmware-2019 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-15442 · Nota de Segurança