PT-2012-1975 · Htc · Sensation Z710E+8

Published 2012-02-05 · Updated 2012-02-16 · CVE-2011-4872

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40, and EVO 4G GRI40

Description The issue allows remote attackers to obtain 802.1X Wi-Fi credentials and SSID via a crafted application that uses the android.permission.ACCESS WIFI STATE permission to call the toString method on the WifiConfiguration class.

Recommendations For the affected HTC Android devices, consider restricting the use of the android.permission.ACCESS WIFI STATE permission to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2011-4872

Affected Products

Desire Hd

Desire S

Droid Incredible

Evo 3D

Evo 4G

Glacier

Sensation 4G

Sensation Z710E

Thunderbolt 4G

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2011-4872 · Security Note
• http://secunia.com/advisories/47837 · Vendor Advisory
• http://kb.cert.org/vuls/id/763355 · Note
• http://securityfocus.com/bid/51790 · Note
• http://archives.neohapsis.com/archives/bugtraq/2012-02/0002.html · Note
• http://blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html · Note