PT-2012-5133 · Gree+1 · Gree+7

Katsuhiko Sato + 1 · Published 2012-08-17 · Updated 2015-11-10 · CVE-2012-4006

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions GREE application versions prior to 1.4.0 GREE Tanken Dorirando application versions prior to 1.0.7 GREE Tsurisuta application versions prior to 1.5.0 GREE Monpura application versions prior to 1.1.1 GREE Kaizokuoukoku Columbus application versions prior to 1.3.5 GREE haconiwa application versions prior to 1.1.0 GREE Seisen Cerberus application versions prior to 1.1.0 KDDI&GREE GREE Market application versions prior to 2.1.2 for Android

Description The issue allows remote attackers to obtain sensitive information via a crafted application due to improper implementation of the WebView class.

Recommendations Update the GREE application to version 1.4.0 or later. Update the GREE Tanken Dorirando application to version 1.0.7 or later. Update the GREE Tsurisuta application to version 1.5.0 or later. Update the GREE Monpura application to version 1.1.1 or later. Update the GREE Kaizokuoukoku Columbus application to version 1.3.5 or later. Update the GREE haconiwa application to version 1.1.0 or later. Update the GREE Seisen Cerberus application to version 1.1.0 or later. Update the KDDI&GREE GREE Market application to version 2.1.2 or later for Android.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2012-4006

Affected Products

Gree

Gree Kaizokuoukoku Columbus

Gree Monpura

Gree Seisen Cerberus

Gree Tanken Dorirando

Gree Tsurisuta

Gree Haconiwa

Kddi&Gree Gree Market

References · 3

• http://jvn.jp/en/jp/JVN99192898/index.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4006 · Security Note
• http://jvndb.jvn.jp/jvndb/JVNDB-2012-000077 · Vendor Advisory