PT-2018-10917 · Mozilla+1 · Firefox Os+1

Published 2018-11-27 · Updated 2019-10-03 · CVE-2018-11946

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:A/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Android for MSM (affected versions not specified) Firefox OS for MSM (affected versions not specified) QRD Android (affected versions not specified)

Description The issue concerns the UPnP daemon in Android releases, which should not be running by default as it allows port forwarding without authentication.

Recommendations For Android for MSM, consider disabling the UPnP daemon to prevent unauthorized port forwarding. For Firefox OS for MSM, disable the UPnP daemon as a mitigation measure. For QRD Android, restrict access to the UPnP daemon until a proper fix is applied.

Fix

Related Identifiers

CVE-2018-11946

Affected Products

Android

Firefox Os

References · 3

• https://codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin · Patch
• https://source.codeaurora.org/quic/qsdk/oss/system/feeds/routing/commit/?id=3f625190fb469cb56de619eae6b5ca8db2463d5b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-11946 · Security Note