PT-2019-9079 · Sony+1 · Sony Xperia L1+1

Publicado

2019-04-25

·

Atualizado

2019-05-02

·

CVE-2018-14983

CVSS v2.0

2.1

Baixa

VetorAV:L/AC:L/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions Sony Xperia L1 Android device with a build fingerprint of Sony/G3313/G3313:7.0/43.0.A.6.49/2867558199:user/release-keys android framework (versionCode=24, versionName=7.0)
Description The android framework in the Sony Xperia L1 Android device contains a modified system server process that allows any app co-located on the device to initiate the taking of a screenshot and write it to external storage. This action is not transparent to the user, as it triggers a screen animation and a notification. If the attacking app has the EXPAND STATUS BAR permission, it can wake the device and expand the status bar to take a screenshot of the user's notifications, potentially accessing sensitive data such as text messages used in two-factor authentication.
Recommendations For the Sony Xperia L1 Android device with the specified build fingerprint, consider disabling the EXPAND STATUS BAR permission for untrusted apps to minimize the risk of exploitation. As a temporary workaround, avoid using the device for sensitive operations until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-14983

Produtos afetados

Android
Sony Xperia L1