Permissions, Privileges, and Access Controls in Google, Google Android

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU40348

Risk: Medium

CVSSv4.0: 1.8 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-2423

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local non-authenticated attacker to #BASIC_IMPACT#.

server/telecom/CallsManager.java in Telephony in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider whether a device is provisioned, which allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 26303187.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Android: 4.0 - 6.0.1

CPE2.3

• cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:google:android:*:*:*:*:*:*:*:*

External links

https://source.android.com/security/bulletin/2016-04-02.html
https://android.googlesource.com/platform/packages/services/Telecomm/+/a06c9a4aef69ae27b951523cf72bf72412bf48fa

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.