PT-2019-15561 · Google+1 · Android+1

Publicado 2019-11-02 · Atualizado 2021-07-21 · CVE-2019-18659

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions LTE phones (affected versions not specified)

Description The issue concerns the Wireless Emergency Alerts (WEA) protocol, which lacks cryptographic authentication, allowing remote attackers to spoof a Presidential Alert. This can be demonstrated by MessageIdentifier 4370 in LTE System Information Block 12 (aka SIB12). Testing has suggested that all LTE phones are affected by design, regardless of the operating system used, such as Android or iOS.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-290

Identificadores relacionados

CVE-2019-18659

Produtos afetados

Android

Ios

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2019-18659 · Nota de Segurança
• https://dl.acm.org/citation.cfm?id=3326082 · Nota