PT-2019-14109 · Google+2 · Android+2

Published 2019-11-14 · Updated 2020-08-24 · CVE-2019-15380

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Fly Photo Pro Android device with a build fingerprint of Fly/PhotoPro/Photo Pro:8.1.0/O11019/1528117003:user/release-keys com.mediatek.wfo.impl app version 8.1.0

Description The issue concerns a pre-installed app on the Fly Photo Pro Android device that allows any co-located app to modify a system property without proper authorization. This is due to an exported interface in the com.mediatek.wfo.impl app.

Recommendations For the Fly Photo Pro Android device with the specified build fingerprint, consider restricting access to the exported interface of the com.mediatek.wfo.impl app to prevent unauthorized modification of system properties. For the com.mediatek.wfo.impl app version 8.1.0, as a temporary workaround, consider disabling the app's ability to modify system properties until a patch is available.

Fix

Related Identifiers

CVE-2019-15380

Affected Products

Android

Fly Photo Pro

Com.Mediatek.Wfo.Impl

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2019-15380 · Security Note
• https://kryptowire.com/android-firmware-2019 · Note