PT-2019-18304 · Samsung · Samsung Knox

James Dean · Published 2019-05-29 · Updated 2024-12-22 · CVE-2019-6744

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Samsung Knox version 1.2.02.39

Description This issue allows local attackers to disclose sensitive information on affected installations. An attacker must first obtain physical access to the device to exploit this. The flaw exists within the handling of the lock screen for Secure Folder, resulting from the lack of proper validation that a user has correctly authenticated. This can be leveraged to disclose the contents of the secure container.

Recommendations For Samsung Knox version 1.2.02.39, consider disabling the lock screen feature for Secure Folder until a patch is available to prevent exploitation. Restrict physical access to devices to minimize the risk of this issue being exploited.

Fix

Improper Access Control

Improper Authentication

Weakness Enumeration

CWE-284

CWE-287

Related Identifiers

CVE-2019-6744

ZDI-19-515

Affected Products

Samsung Knox

References · 5

• https://osv.dev/vulnerability/CVE-2019-6744 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-19-515 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-6744 · Security Note
• https://security.samsungmobile.com/securityUpdate.smsb · Note
• https://twitter.com/CFCMatters/status/1870847076864872518 · Twitter Post