PT-2017-7762 · Google+1 · Android+1

Tom Karygiannis · Published 2017-01-13 · Updated 2017-03-16 · CVE-2016-10137

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BLU R1 HD devices with Shanghai Adups software

Description An issue allows any app on the device to read, write, and delete files as the system user due to the content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper. This app executes as the system user because it sets the android:sharedUserId attribute to android.uid.system in its AndroidManifest.xml file. As a result, a third-party app can access the user's sent and received text messages and call log, obtaining personally identifiable information (PII) without permission.

Recommendations For BLU R1 HD devices with Shanghai Adups software, consider disabling the com.adups.fota.sysoper app or restricting its access to sensitive data until a fix is available. Avoid using the com.adups.fota.sysoper.provider.InfoProvider content provider in other apps to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2016-10137

Affected Products

Android

Blu R1 Hd

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-10137 · Security Note
• https://nytimes.com/2016/11/16/us/politics/china-phones-software-security.html · Note
• http://securityfocus.com/bid/96852 · Note
• https://kryptowire.com/adups_security_analysis.html · Note