PT-2024-12704 · At&T+2 · At&T Calypso+3

Published 2024-04-22 · Updated 2024-10-31 · CVE-2023-38299

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AT&T Calypso version ATT/U318AA/U318AA:10/QP1A.190711.020/1632369780:user/release-keys Nokia C100 versions Nokia/DrakeLite 02US/DKT:12/SP1A.210812.016/02US 1 190:user/release-keys through Nokia/DrakeLite 02US/DKT:12/SP1A.210812.016/02US 1 270:user/release-keys Nokia C200 version Nokia/Drake 02US/DRK:12/SP1A.210812.016/02US 1 080:user/release-keys BLU View 3 versions BLU/B140DL/B140DL:11/RP1A.200720.011/1628014629:user/release-keys through BLU/B140DL/B140DL:11/RP1A.200720.011/1672371162:user/release-keys

Description The issue concerns various software builds for the AT&T Calypso, Nokia C100, Nokia C200, and BLU View 3 devices, which leak the device IMEI to a system property that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers in Android 10 and higher, but in these instances, they are leaked by a high-privilege process and can be obtained indirectly. A malicious app can read from the persist.sys.imei1 system property to indirectly obtain the device IMEI.

Recommendations For AT&T Calypso version ATT/U318AA/U318AA:10/QP1A.190711.020/1632369780:user/release-keys, restrict access to the persist.sys.imei1 system property to prevent indirect obtainment of the device IMEI. For Nokia C100 versions Nokia/DrakeLite 02US/DKT:12/SP1A.210812.016/02US 1 190:user/release-keys through Nokia/DrakeLite 02US/DKT:12/SP1A.210812.016/02US 1 270:user/release-keys, restrict access to the persist.sys.imei1 system property to prevent indirect obtainment of the device IMEI. For Nokia C200 version Nokia/Drake 02US/DRK:12/SP1A.210812.016/02US 1 080:user/release-keys, restrict access to the persist.sys.imei1 system property to prevent indirect obtainment of the device IMEI. For BLU View 3 versions BLU/B140DL/B140DL:11/RP1A.200720.011/1628014629:user/release-keys through BLU/B140DL/B140DL:11/RP1A.200720.011/1672371162:user/release-keys, restrict access to the persist.sys.imei1 system property to prevent indirect obtainment of the device IMEI. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2023-38299

Affected Products

At&T Calypso

Blu View 3

Nokia C100

Nokia C200

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-38299 · Security Note
• https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf · Note
• https://t.me/cvenotify/77693 · Telegram Post
• https://t.me/cvenotify/77657 · Telegram Post