PT-2018-9923 · Samsung · Samsung Galaxy Apps

Alex Plaskett + 3 · Published 2018-06-07 · Updated 2019-10-09 · CVE-2018-10502

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Samsung Galaxy Apps versions prior to 4.2.18.2

Description: This issue allows local attackers to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the handling of a staging mode, specifically in the ability to change the configuration based on the presence of a file in a user-controlled location. This can be leveraged to escalate privileges to resources normally protected from the application.

Recommendations: For versions prior to 4.2.18.2, update to version 4.2.18.2 to resolve the issue. As a temporary workaround, consider restricting access to the staging mode to minimize the risk of exploitation.

Fix

RCE

Improper Privilege Management

Weakness Enumeration

CWE-20

CWE-269

Related Identifiers

CVE-2018-10502

ZDI-18-560

Affected Products

Samsung Galaxy Apps

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-10502 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-560 · Security Note
• https://osv.dev/vulnerability/CVE-2018-10502 · Vendor Advisory