Vulnerability CVE-2012-3887

Vulnerability CVE-2012-3887

Published: 2012-07-26 Modified: 2012-07-27

Description:

AirDroid before 1.0.7 beta uses a cleartext base64 format for data transfer that is documented as an "Encrypted Transmission" feature, which allows remote attackers to obtain sensitive information by sniffing the local wireless network, as demonstrated by the SMS message content sent to the sdctl/sms/send/single/ URI.

See advisories in our WLB2 database:

	Topic	Author	Date
High	AirDroid 1.0.4 several weaknesses	tele-consulting	07.08.2012

Type:

CWE-310

(Cryptographic Issues)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
5/10	2.9/10	10/10

Exploit range	Attack complexity	Authentication
Remote	Low	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	None	None

Affected software
Airdroid -> Airdroid

References:

http://www.tele-consulting.com/advisories/TC-SA-2012-02.txt

http://archives.neohapsis.com/archives/bugtraq/2012-07/0087.html

Copyright 2024, cxsecurity.com