Incorrect default permissions in Google, Google Android

1) Incorrect default permissions

EUVDB-ID: #VU22484

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-2114

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions within the Android Beam service when installing application transferred via NFC. An attacker with physical proximity to the device can transfer a malicious application to the device and trick the victim into installing it just by tapping on the notification. No additional warnings are displayed for apps, transferred via NFC beaming.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Google Android: 8.0 - 9.0

CPE2.3

• cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*
• cpe:2.3:o:google:android:*:*:*:*:*:*:*:*

External links

https://source.android.com/security/bulletin/2019-10-01
https://wwws.nightwatchcybersecurity.com/2019/10/24/nfc-beaming-bypasses-security-controls-in-android-cve-2019-2114/

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.