PT-2017-3599 · Mozilla+2 · Firefox Os+2

Published 2017-08-31 · Updated 2018-04-06 · CVE-2017-15815

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Android for MSM versions (affected versions not specified) QRD Android versions (affected versions not specified) Firefox OS for MSM versions (affected versions not specified) All Android releases from CAF using the Linux kernel versions (affected versions not specified)

Description: A potential buffer overflow issue exists when processing 802.11 MGMT frames, such as Auth frames, in the limProcessAuthFrame function. This issue is related to the WLAN component of the Android operating system from the CAF repository. Exploitation of this issue may allow a remote attacker to execute arbitrary code.

Recommendations: For Android for MSM, consider disabling the WLAN component until a patch is available. For QRD Android, restrict access to the limProcessAuthFrame function to minimize the risk of exploitation. For Firefox OS for MSM, avoid using the WLAN component in the affected Android releases from CAF using the Linux kernel until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2018-00545

CVE-2017-15815

Affected Products

Android

Firefox Os

Linux Kernel

References · 5

• https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=a5096157fd80350a0e0409e7ad96265ae60861f6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-15815 · Security Note
• https://source.android.com/security/bulletin/2018-03-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00545 · Security Note
• http://securityfocus.com/bid/103254 · Note