PT-2017-2935 · Kaspersky · Kaspersky Internet Security For Android

Published 2017-08-09 · Updated 2021-06-17 · CVE-2017-12816

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kaspersky Internet Security for Android version 11.12.4.1622

Description The issue is related to insufficient access control in Kaspersky Internet Security for Android, which can be exploited by a remote attacker to gain unauthorized access to the product's functionality using the Android Inter-Process Communication (IPC) system. This could potentially allow a malware application to access the product's features without proper authorization.

Recommendations For Kaspersky Internet Security for Android version 11.12.4.1622, consider restricting access to the application's exported activities to minimize the risk of exploitation until a patch is available. As a temporary workaround, review and limit the use of Android IPC to reduce the potential for unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

CWE-264

Related Identifiers

BDU:2017-02260

CVE-2017-12816

Affected Products

Kaspersky Internet Security For Android

References · 5

• https://support.kaspersky.com/vulnerability.aspx?el=12430#090817 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12816 · Security Note
• https://bdu.fstec.ru/vul/2017-02260 · Security Note
• https://osv.dev/vulnerability/CVE-2017-12816 · Vendor Advisory
• http://securityfocus.com/bid/100505 · Note