PT-2015-3956 · Google · Android

Published 2015-03-12 · Updated 2020-02-26 · CVE-2014-7914

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Android versions prior to 5.1

Description The issue allows user-assisted remote attackers to bypass intended access restrictions via crafted Bluetooth packets after the tapping of a crafted NFC tag. This is due to the improper enforcement of the temporary nature of a Bluetooth pairing in the btif/src/btif dm.c file.

Recommendations For Android versions prior to 5.1, update to version 5.1 or later to resolve the issue. As a temporary workaround, consider restricting Bluetooth pairing to trusted devices and avoiding the use of NFC tags from untrusted sources.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2014-7914

ZDI-15-092

Affected Products

Android

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-7914 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-15-092 · Security Note
• https://android.googlesource.com/platform/external/bluetooth/bluedroid/+/0360aa7c418152a3e5e335a065ac3629cbb09559 · Vendor Advisory
• https://t.me/cvenotify/1129 · Telegram Post