Vulnerability CVE-2012-5564


Published: 2013-02-14

Description:
android-tools 4.1.1 in Android Debug Bridge (ADB) allows local users to overwrite arbitrary files via a symlink attack on /tmp/adb.log.

Type:

CWE-59

(Improper Link Resolution Before File Access ('Link Following'))

Vendor: Google
Product: Android sdk tools 
Version: 4.1.1;

CVSS2 => (AV:L/AC:M/Au:N/C:N/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.3/10
4.9/10
3.4/10
Exploit range
Attack complexity
Authentication
Local
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
Partial

 References:
https://bugzilla.redhat.com/show_bug.cgi?id=879582
http://www.securityfocus.com/bid/56653
http://www.openwall.com/lists/oss-security/2012/11/23/8
http://www.openwall.com/lists/oss-security/2012/11/23/1
http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098532.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098529.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098527.html
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688280

Related CVE
CVE-2016-5345
Buffer overflow in the Qualcomm radio driver in Android before 2017-01-05 on Android One devices allows local users to gain privileges via a crafted application, aka Android internal bug 32639452 and Qualcomm internal bug CR1079713.
CVE-2017-17860
In Samsung Gear products, Bluetooth link key is updated to the different key which is same with attacker's link key. It can be attacked without user's intention only if attacker can reveal the Bluetooth address of target device and paired user's smar...
CVE-2017-11072
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while calculating CRC for GPT header fields with partition entries greater than 16384 buffer overflow occurs.
CVE-2017-13226
An elevation of privilege vulnerability in the MediaTek mtk. Product: Android. Versions: Android kernel. Android ID: A-32591194. References: M-ALPS03149184.
CVE-2017-13225
In libMtkOmxVdec.so there is a possible heap buffer overflow. This could lead to a remote elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is needed for exploitati...
CVE-2017-13222
An information disclosure vulnerability in the Upstream kernel kernel. Product: Android. Versions: Android kernel. Android ID: A-38159576.
CVE-2017-13221
An elevation of privilege vulnerability in the Upstream kernel wifi driver. Product: Android. Versions: Android kernel. Android ID: A-64709938.
CVE-2017-13220
An elevation of privilege vulnerability in the Upstream kernel bluez. Product: Android. Versions: Android kernel. Android ID: A-63527053.

Copyright 2018, cxsecurity.com

 

Back to Top