PT-2020-13301 · Government Of Alberta+2 · Abtracetogether+2

Alwen Tiu + 1 · Published 2020-05-18 · Updated 2020-11-01 · CVE-2020-12856

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenTrace versions prior to 1.0.18 COVIDSafe versions prior to 1.0.18 TraceTogether versions prior to 1.0.18 ABTraceTogether versions prior to 1.0.18

Description The issue allows remote attackers to conduct long-term re-identification attacks and possibly have unspecified other impact, because of how Bluetooth is used.

Recommendations For OpenTrace version 1.0.17 and earlier, update to version 1.0.18 or later. For COVIDSafe version 1.0.17 and earlier, update to version 1.0.18 or later. For TraceTogether version 1.0.17 and earlier, update to version 1.0.18 or later. For ABTraceTogether version 1.0.17 and earlier, update to version 1.0.18 or later.

Exploit

Fix

Related Identifiers

ASB-A-157038281

CVE-2020-12856

Affected Products

Abtracetogether

Covidsafe

Opentrace

References · 13

• 🔥 https://github.com/alwentiu/COVIDSafe-CVE-2020-12856 · Exploit
• 🔥 https://github.com/alwentiu/COVIDSafe-CVE-2020-12856/blob/master/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-12856 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12856 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-157038281 · Vendor Advisory
• https://android.googlesource.com/platform/packages/apps/Bluetooth/+/81c1c7d2d1681434413a615eea532e85fee43db0 · Note
• https://android.googlesource.com/platform/system/bt/+/73b4e5c4ba4c0c96a26ec84564cd9653da50a26c · Note
• https://source.android.com/security/bulletin/2020-11-01 · Note
• https://android.googlesource.com/platform/system/bt/+/b3f12befdc4def7d695b6f1049cd02238eb1e4a8 · Note
• https://covidsafe.watch/issue-register/cve-2020-12856-long-term-tracking-and-possibly-enables-other-bluetooth-based-attack-vectors · Note
• https://t.me/cvenotify/3872 · Telegram Post
• https://android.googlesource.com/platform/system/bt/+/05243b881764136d3ca67b438d2e500d6f134f6a · Note
• https://docs.google.com/document/d/1u5a5ersKBH6eG362atALrzuXo3zuZ70qrGomWVEC27U/edit?usp=sharing · Note