PT-2020-8686 · Samsung · Dual Messenger

Published 2020-04-08 · Updated 2020-04-09 · CVE-2018-21042

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Samsung mobile devices with N(7.x) software Samsung mobile devices with O(8.x) software Samsung mobile devices with P(9.0) software

Description An issue was discovered that allows installation of an arbitrary APK, resulting in privileged code execution, due to a flaw in the Dual Messenger feature.

Recommendations For Samsung mobile devices with N(7.x) software, update the Dual Messenger application to prevent arbitrary APK installation. For Samsung mobile devices with O(8.x) software, restrict the use of Dual Messenger until a patch is available to prevent privileged code execution. For Samsung mobile devices with P(9.0) software, disable the Dual Messenger feature as a temporary workaround until a fix is provided.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2018-21042

Affected Products

Dual Messenger

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-21042 · Security Note
• https://security.samsungmobile.com/securityUpdate.smsb · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-21042 · Vendor Advisory