PT-2019-14100 · Symphony+2 · Symphony G100+2

Published 2019-11-14 · Updated 2020-08-24 · CVE-2019-15371

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Symphony G100 Android device with a build fingerprint of Symphony/G100/G100:8.1.0/O11019/1530618779:user/release-keys com.mediatek.wfo.impl app version 8.1.0

Description The issue concerns a pre-installed app that allows any co-located app to modify a system property without proper authorization. This is due to an exported interface in the com.mediatek.wfo.impl app.

Recommendations For the Symphony G100 Android device with the specified build fingerprint, consider restricting access to the com.mediatek.wfo.impl app until a patch is available. For the com.mediatek.wfo.impl app version 8.1.0, as a temporary workaround, consider disabling the app's exported interface that allows modification of system properties.

Fix

Related Identifiers

CVE-2019-15371

Affected Products

Android

Symphony G100

Com.Mediatek.Wfo.Impl

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2019-15371 · Security Note
• https://kryptowire.com/android-firmware-2019 · Note