PT-2012-4410 · Google · Android

Glenn Ten Cate · Published 2012-08-21 · Updated 2012-08-21 · CVE-2012-2980

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified) on T-Mobile myTouch 3G Slide, HTC Merge, Sprint EVO Shift 4G, HTC ChaCha, AT&T Status, HTC Desire Z, T-Mobile G2, T-Mobile myTouch 4G Slide, and Samsung Galaxy S

Description The onTouchEvent method implementation for Android on certain devices stores touch coordinates in the dmesg buffer. This allows remote attackers to obtain sensitive information, such as PIN numbers, telephone numbers, and text messages, via a crafted application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2012-2980

Affected Products

Android

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2012-2980 · Security Note
• http://kb.cert.org/vuls/id/MAPG-8R5LD6 · Note
• http://htc.com/www/help/app-security-fix · Note
• http://kb.cert.org/vuls/id/251635 · Note