PT-2018-4682 · Google+1 · Android+2

Published 2018-04-18 · Updated 2018-05-02 · CVE-2016-10456

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Android versions prior to 2018-04-05 security patch level

Description The issue arises when radish is executed with an interface name set to an invalid interface name, potentially allowing an arbitrary command of 15 characters or less to be executed as a system call on certain Qualcomm Snapdragon Mobile and Snapdragon Wear devices.

Recommendations For Android versions prior to 2018-04-05 security patch level, update to a version with a security patch level of 2018-04-05 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-10456

Affected Products

Android

Qualcomm Snapdragon Mobile

Qualcomm Snapdragon Wear

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2016-10456 · Security Note
• https://source.android.com/security/bulletin/2018-04-01 · Vendor Advisory
• http://securityfocus.com/bid/103671 · Note