PT-2017-6698 · Google · Android

Published 2017-06-27 · Updated 2017-07-05 · CVE-2015-3840

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Android versions prior to 5.1.1

Description The issue allows local users to modify the sent and received statuses of SMS and MMS messages without having the necessary "WRITE SMS" permission. This is due to a flaw in the MessageStatusReceiver service defined in the AndroidManifest.XML file.

Recommendations For Android versions prior to 5.1.1, consider restricting access to the MessageStatusReceiver service until a patch is available. As a temporary workaround, review and limit local user permissions to prevent unauthorized modification of message statuses.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2015-3840

Affected Products

Android

References · 4

• 🔥 http://blog.trendmicro.com/trendlabs-security-intelligence/two-new-android-bugs-mess-up-messaging-may-lead-to-multiple-send-charges · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-3840 · Security Note
• https://huntcve.github.io/2017/02/13/cveupdate · Note
• http://blog.trendmicro.com/trendlabs-security-intelligence/os-x-zero-days-on-the-rise-a-2015-midyear-review-on-advanced-attack-surfaces · Note