PT-2013-5184 · Google · Android

Published 2013-09-25 · Updated 2016-12-07 · CVE-2013-4777

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android version 2.3.7 on the Motorola Defy XT phone

Description The issue concerns a specific configuration where the Android operating system uses init to create a socket that listens for shell commands, potentially allowing local users to gain privileges. This is achieved by interacting with a LocalSocket object.

Recommendations For Android 2.3.7 on the Motorola Defy XT phone, consider restricting access to the /dev/socket/init runit socket to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-4777

Affected Products

Android

References · 2

• 🔥 https://plus.google.com/110348415484169880343/posts/5ofgPNrSu3J · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-4777 · Security Note