PT-2017-3697 · Google+1 · Android+1

Published 2017-03-14 · Updated 2018-05-14 · CVE-2017-18074

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Android versions prior to security patch level 2018-04-05

Description: The issue is caused by insufficient input validation in the Qualcomm Audio component of the Android operating system when playing WMA files. This can lead to a reachable assert when a .wma file with a modified media header and a non-standard bytes per second parameter value is played. Exploitation of this issue may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information using a specially crafted WMA file with a modified header.

Recommendations: For Android versions prior to security patch level 2018-04-05, update to a version with a security patch level of 2018-04-05 or later to resolve the issue. As a temporary workaround, consider avoiding the use of .wma files with modified media headers to minimize the risk of exploitation. Restrict access to untrusted .wma files to prevent potential attacks.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2018-00890

CVE-2017-18074

Affected Products

Android

Qualcomm Audio

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-18074 · Security Note
• https://bdu.fstec.ru/vul/2018-00890 · Security Note
• https://source.android.com/security/bulletin/2018-04-01 · Vendor Advisory
• http://securityfocus.com/bid/103671 · Note