PT-2019-18304 · Samsung · Samsung Knox

James Dean · Publicado 2019-05-29 · Atualizado 2024-12-22 · CVE-2019-6744

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Samsung Knox version 1.2.02.39

Description This issue allows local attackers to disclose sensitive information on affected installations. An attacker must first obtain physical access to the device to exploit this. The flaw exists within the handling of the lock screen for Secure Folder, resulting from the lack of proper validation that a user has correctly authenticated. This can be leveraged to disclose the contents of the secure container.

Recommendations For Samsung Knox version 1.2.02.39, consider disabling the lock screen feature for Secure Folder until a patch is available to prevent exploitation. Restrict physical access to devices to minimize the risk of this issue being exploited.

Correção

Improper Access Control

Improper Authentication

Enumeração de Fraquezas

CWE-284

CWE-287

Identificadores relacionados

CVE-2019-6744

ZDI-19-515

Produtos afetados

Samsung Knox

Referências · 5

• https://osv.dev/vulnerability/CVE-2019-6744 · Aviso do Fabricante
• https://security.samsungmobile.com/securityUpdate.smsb · Nota
• https://zerodayinitiative.com/advisories/ZDI-19-515 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-6744 · Nota de Segurança
• https://twitter.com/CFCMatters/status/1870847076864872518 · Publicação no Twitter