PT-2014-2600 · Google · Android

Published 2014-08-31 · Updated 2015-11-10 · CVE-2013-2599

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions 4.1.x through 4.3.x

Description The issue allows attackers to obtain sensitive disk-encryption passwords via a logcat call due to debug logging being enabled by a certain Qualcomm Innovation Center (QuIC) patch to the NativeDaemonConnector class.

Recommendations For Android versions 4.1.x through 4.3.x, consider disabling debug logging in the NativeDaemonConnector class as a temporary workaround until a patch is available. Restrict access to logcat calls to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2013-2599

Affected Products

Android

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2013-2599 · Security Note
• https://codeaurora.org/projects/security-advisories/logging-potentially-sensitive-information-nativedaemonconnector-cve-2013-2599 · Vendor Advisory