Vulnerability CVE-2012-4006


Published: 2012-08-17

Description:
The GREE application before 1.4.0, GREE Tanken Dorirando application before 1.0.7, GREE Tsurisuta application before 1.5.0, GREE Monpura application before 1.1.1, GREE Kaizokuoukoku Columbus application before 1.3.5, GREE haconiwa application before 1.1.0, GREE Seisen Cerberus application before 1.1.0, and KDDI&GREE GREE Market application before 2.1.2 for Android do not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application.

Vendor: Kddi & gree
Product: Gree market 
Version: 2.1.1;
Vendor: GREE
Product: Tsurisuta 
Version: 1.4.9;
Product: GREE 
Version: 1.3.9;
Product: Kaizokuoukoku columbus 
Version: 1.3.4;
Product: Monpura 
Version: 1.1.0;
Product: Seisen cerberus 
Version: 1.0.9;
Product: Haconiwa 
Version: 1.0.9;
Product: Tanken dorirando 
Version: 1.0.6;

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None

 References:
http://jvndb.jvn.jp/jvndb/JVNDB-2012-000077
http://jvn.jp/en/jp/JVN99192898/index.html

Related CVE
CVE-2016-5430
The RSA 1.5 algorithm implementation in the JOSE_JWE class in JWE.php in jose-php before 2.2.1 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).
CVE-2016-5429
jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php.
CVE-2013-0704
Directory traversal vulnerability in the GREE application before 1.3.3 for Android allows remote attackers to obtain sensitive information via a crafted URL, which is not properly handled during interaction with other applications.

Copyright 2019, cxsecurity.com

 

Back to Top