PT-2019-14363 · Google+1 · Android+1
Publicado
2019-11-14
·
Atualizado
2019-11-19
·
CVE-2019-15743
CVSS v2.0
2.1
Baixa
| Vetor | AV:L/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Sony Xperia Touch Android device with a build fingerprint of Sony/blanc windy/blanc windy:7.0/LOIRE-SMART-BLANC-1.0.0-170530-0834/1:user/dev-keys
Description
The issue concerns a pre-installed app with a package name of
com.sonymobile.android.maintenancetool.testmic that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device, enabling a third-party app to use its open interface to record audio to external storage.Recommendations
For the Sony Xperia Touch Android device, consider restricting access to the
com.sonymobile.android.maintenancetool.testmic app to minimize the risk of exploitation. As a temporary workaround, consider disabling the app's ability to record audio to external storage until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability. Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Android
Sony Xperia Touch