Vulnerability CVE-2012-2980
Published: 2012-08-21

Description:
The Samsung and HTC onTouchEvent method implementation for Android on the T-Mobile myTouch 3G Slide, HTC Merge, Sprint EVO Shift 4G, HTC ChaCha, AT&T Status, HTC Desire Z, T-Mobile G2, T-Mobile myTouch 4G Slide, and Samsung Galaxy S stores touch coordinates in the dmesg buffer, which allows remote attackers to obtain sensitive information via a crafted application, as demonstrated by PIN numbers, telephone numbers, and text messages.

Type:

CWE-255

 (Credentials Management)

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.1/10
6.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
None
None
Affected software
T-mobile -> G2 
T-mobile -> Mytouch 3g slide 
T-mobile -> Mytouch 4g slide 
Sprint -> Evo shift 4g 
Samsung -> Galaxy s 
HTC -> Chacha 
HTC -> Desire 
HTC -> Merge 
ATT -> Status 

 References:
http://www.kb.cert.org/vuls/id/251635
http://www.kb.cert.org/vuls/id/MAPG-8R5LD6
http://www.htc.com/www/help/app-security-fix/
Copyright 2024, cxsecurity.com

 

Back to Top