PT-2016-4835 · Lenovo · Shareit

Ivan Huertas · Published 2016-01-26 · Updated 2018-10-09 · CVE-2016-1489

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Lenovo SHAREit versions prior to 3.2.0 for Windows Lenovo SHAREit versions prior to 3.5.48 ww for Android

Description The issue allows remote attackers to obtain sensitive information or conduct man-in-the-middle attacks. This is possible because files are transferred in cleartext, making it easier for attackers to intercept data by sniffing the network or via unspecified vectors.

Recommendations For Windows versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue. For Android versions prior to 3.5.48 ww, update to version 3.5.48 ww or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-254

CWE-200

Related Identifiers

CVE-2016-1489

Affected Products

Shareit

References · 7

• https://osv.dev/vulnerability/CVE-2016-1489 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1489 · Security Note
• https://support.lenovo.com/us/en/product_security/len_4058 · Vendor Advisory
• http://coresecurity.com/advisories/lenovo-shareit-multiple-vulnerabilities · Vendor Advisory
• http://packetstormsecurity.com/files/135378/Lenovo-ShareIT-Information-Disclosure-Hardcoded-Password.html · Note
• http://seclists.org/fulldisclosure/2016/Jan/67 · Note
• http://securityfocus.com/archive/1/537365/100/0/threaded · Note