PT-2014-4344 · Drinkedin+1 · Drinkedin Barfinder+1

Published 2014-03-03 · Updated 2014-03-07 · CVE-2014-1887

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions DrinkedIn BarFinder application for Android versions with Adobe PhoneGap 2.9.0 or earlier

Description The issue allows remote attackers to execute arbitrary JavaScript code and obtain sensitive fine-geolocation information by leveraging control over certain adult sites. This can be achieved by exploiting the vulnerability in the DrinkedIn BarFinder application when it uses Adobe PhoneGap 2.9.0 or earlier.

Recommendations For DrinkedIn BarFinder application for Android versions with Adobe PhoneGap 2.9.0 or earlier, consider updating Adobe PhoneGap to a version later than 2.9.0 to mitigate the risk of arbitrary JavaScript code execution. As a temporary workaround, restrict access to the application's geolocation features until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-1887

Affected Products

Phonegap

Drinkedin Barfinder

References · 4

• 🔥 http://cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-1887 · Security Note
• http://internetsociety.org/ndss2014/programme#session3 · Note
• http://openwall.com/lists/oss-security/2014/02/07/9 · Note