SB2024110618 - Multiple vulnerabilities in Samsung Android Applications
Published: November 6, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2024-49403)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. An attacker with physical access can bypass implemented security restrictions and access recording files on the lock screen.
2) Improper access control (CVE-ID: CVE-2024-49404)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. An attacker with physical access can bypass implemented security restrictions and access video file of other users.
3) Improper Authentication (CVE-ID: CVE-2024-49405)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local attacker to bypass authentication process.
The vulnerability exists due to an error when processing authentication requests in Private Info. An attacker with physical access can bypass authentication process and access sensitive information in a specific scenario.
4) Improper validation of integrity check value (CVE-ID: CVE-2024-49406)
CWE-ID: CWE-354 - Improper Validation of Integrity Check Value
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to compromise the target system.
The vulnerability exists due to improper validation of integrity check value. A local administrator can modify transaction.
5) Improper access control (CVE-ID: CVE-2024-49407)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. An attacker with physical access can bypass implemented security restrictions and access data across multiple user profiles.
Remediation
Install update from vendor's website.