PT-2020-7740 · Google · Android

Imre Rad · Published 2020-02-20 · Updated 2020-02-25 · CVE-2014-7951

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Android versions 4.0.4

Description A directory traversal issue exists in the Android debug bridge, allowing physically proximate attackers with a direct connection to the target device to write to arbitrary system-owned files by using a .. (dot dot) in the tar archive headers.

Recommendations For Android version 4.0.4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2014-7951

Affected Products

Android

References · 6

• 🔥 http://packetstormsecurity.com/files/131510/ADB-Backup-Traversal-File-Overwrite.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Apr/51 · Exploit
• 🔥 https://exploit-db.com/exploits/36813 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-7951 · Security Note
• http://securityfocus.com/bid/74211 · Note
• https://android.googlesource.com/platform/frameworks/base/+/7bc601d%5E%21/#F0 · Note