PT-2019-14602 · Samsung · Samsungtts

Flanker017 · Publicado 2019-09-25 · Atualizado 2024-03-23 · CVE-2019-16253

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SamsungTTS versions prior to 3.0.02.7 SamsungTTS version 3.0.00.101

Description The issue allows a local attacker to escalate privileges, for example, to system privileges. It is related to the handling of debugging flags by the package manager binary. There is an estimated exploit that uses this issue as a payload.

Recommendations For SamsungTTS versions prior to 3.0.02.7, update to version 3.0.02.7 or later. For SamsungTTS version 3.0.00.101, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the package manager binary until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2019-16253

Produtos afetados

Samsungtts

Referências · 8

• 🔥 https://github.com/flankerhqd/vendor-android-cves/tree/master/SMT-CVE-2019-16253 · Exploit
• 🔥 https://github.com/k0mraid3/K0mraid3s-System-Shell-PREBUILT · Exploit
• 🔥 http://packetstormsecurity.com/files/154614/Samsung-Mobile-Android-SamsungTTS-Privilege-Escalation.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-16253 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-16253 · Nota de Segurança
• https://t.me/defcon_news/25547 · Publicação no Telegram
• https://twitter.com/akaclandestine/status/1771525424415134208 · Publicação no Twitter
• https://blog.flanker017.me/text-to-speech-speaks-pwned · Nota