PT-2019-13540 · Bluestacks · Bluestacks

Published 2019-09-24 · Updated 2021-09-08 · CVE-2019-14220

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BlueStacks versions 4.110 and below on macOS BlueStacks versions 4.120 and below on Windows

Description The issue concerns a local arbitrary file read through a system service call. It affects the method that runs with System admin privilege, allowing it to return the content of a file given the file name as a parameter. A malicious app can exploit this to read the content of any system file it is not authorized to read.

Recommendations For BlueStacks versions 4.110 and below on macOS, consider restricting access to system service calls until a patch is available. For BlueStacks versions 4.120 and below on Windows, consider disabling the affected method to prevent unauthorized file reads. As a temporary workaround, avoid using the affected system service call with sensitive file names until the issue is resolved.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2019-14220

Affected Products

Bluestacks

References · 4

• https://support.bluestacks.com/hc/en-us/articles/360033484132-BlueStacks-fails-to-restrict-access-permissions · Vendor Advisory
• https://support.bluestacks.com/hc/en-us/articles/360021469391-Release-Notes · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14220 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14220 · Security Note