Sign-up

ID

VAR-201201-0267


CVE

CVE-2011-4769


TITLE

Android for 360 MobileSafe In SMS Message and contact list read vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2012-001211

DESCRIPTION

The 360 MobileSafe (com.qihoo360.mobilesafe) application 2.x before 2.3.0 for Android does not properly protect data, which allows remote attackers to read or modify SMS messages and a contact list via a crafted application. 360 MobileSafe is prone to a remote unauthorized access vulnerability. An attacker can exploit this issue to access and manipulate a user's blacklist, SMS, contacts, and call logs. 360 MobileSafe 2.1.0 and 2.2.0 are affected; other versions may also be vulnerable. Google Chrome is a web browser developed by Google (Google). Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance (OHA). A vulnerability exists in the 360 ​​MobileSafe (com.qihoo360.mobilesafe) app version 2.1.0 and 2.2.0 for Android due to failure to properly secure data. ---------------------------------------------------------------------- Secunia presentations @ RSA Conference 2012, San Francisco, USA, 27 Feb-02 March Listen to our Chief Security Specialist, Research Analyst Director, and Director Product Management & Quality Assurance discuss the industry's key topics. Also, visit the Secunia stand #817. Find out more: http://www.rsaconference.com/events/2012/usa/index.htm ---------------------------------------------------------------------- TITLE: 360 MobileSafe for Android Security Bypass Security Issue SECUNIA ADVISORY ID: SA47838 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/47838/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=47838 RELEASE DATE: 2012-02-09 DISCUSS ADVISORY: http://secunia.com/advisories/47838/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/47838/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=47838 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: AppSec has reported a security issue in 360 MobileSafe for Android, which can be exploited by malicious people to bypass certain security restrictions. The security issue is caused due to an unspecified error and can be exploited to disclose and manipulate certain sensitive information like e.g. Successful exploitation requires that a malicious application is installed. The security issue is reported in versions 2.1.0 and 2.2.0. SOLUTION: Reportedly fixed in version 2.3.0. PROVIDED AND/OR DISCOVERED BY: Daoyuan Wu, Xiapu Luo, and Rocky K. C. Chang, Department of Computing, The Hong Kong Polytechnic University ORIGINAL ADVISORY: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4769-vulnerability-in-360MobileSafe.html OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2011-4769 // JVNDB: JVNDB-2012-001211 // BID: 51694 // VULHUB: VHN-52714 // PACKETSTORM: 109600

AFFECTED PRODUCTS

vendor:360model:mobilesafescope:eqversion:2.2.0

Trust: 1.6

vendor:360model:mobilesafescope:eqversion:2.1.0

Trust: 1.6

vendor:qihoo 360model:mobile safescope:eqversion:2.1.0 and 2.2.0

Trust: 0.8

vendor:qihoomodel:technology mobilesafescope:eqversion:3603602.2

Trust: 0.3

vendor:qihoomodel:technology mobilesafescope:eqversion:3603602.1.0

Trust: 0.3

sources: BID: 51694 // JVNDB: JVNDB-2012-001211 // CNNVD: CNNVD-201201-352 // NVD: CVE-2011-4769

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2011-4769
value: MEDIUM

Trust: 1.0

NVD: CVE-2011-4769
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201201-352
value: MEDIUM

Trust: 0.6

VULHUB: VHN-52714
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2011-4769
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-52714
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-52714 // JVNDB: JVNDB-2012-001211 // CNNVD: CNNVD-201201-352 // NVD: CVE-2011-4769

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.9

sources: VULHUB: VHN-52714 // JVNDB: JVNDB-2012-001211 // NVD: CVE-2011-4769

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201201-352

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201201-352

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2012-001211

PATCH
title:Top Pageurl:http://corp.360.cn
Trust: 0.8
title:360MobileSafe_androidurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=42485
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2012-001211 // 
            
            
            
            CNNVD: CNNVD-201201-352

EXTERNAL IDS
db:NVDid:CVE-2011-4769
Trust: 2.9
db:JVNDBid:JVNDB-2012-001211
Trust: 0.8
db:CNNVDid:CNNVD-201201-352
Trust: 0.7
db:NSFOCUSid:18617
Trust: 0.6
db:BIDid:51694
Trust: 0.4
db:SECUNIAid:47838
Trust: 0.2
db:VULHUBid:VHN-52714
Trust: 0.1
db:PACKETSTORMid:109600
Trust: 0.1
sources:
            
            
            VULHUB: VHN-52714 // 
            
            
            
            BID: 51694 // 
            
            
            
            JVNDB: JVNDB-2012-001211 // 
            
            
            
            PACKETSTORM: 109600 // 
            
            
            
            CNNVD: CNNVD-201201-352 // 
            
            
            
            NVD: CVE-2011-4769

REFERENCES
url:http://www4.comp.polyu.edu.hk/~appsec/bugs/cve-2011-4769-vulnerability-in-360mobilesafe.html
Trust: 2.9
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4769
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4769
Trust: 0.8
url:http://www.nsfocus.net/vulndb/18617
Trust: 0.6
url:http://corp.360.cn/
Trust: 0.3
url:http://secunia.com/advisories/47838/#comments
Trust: 0.1
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:http://www.rsaconference.com/events/2012/usa/index.htm
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/advisories/47838/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=47838
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-52714 // 
            
            
            
            BID: 51694 // 
            
            
            
            JVNDB: JVNDB-2012-001211 // 
            
            
            
            PACKETSTORM: 109600 // 
            
            
            
            CNNVD: CNNVD-201201-352 // 
            
            
            
            NVD: CVE-2011-4769

CREDITS
Daoyuan Wu, Xiapu Luo and Rocky K. C. Chang Department of Computing, The Hong Kong Polytechnic University, Hong Kong
Trust: 0.3
sources:
            
            
            BID: 51694

SOURCES
db:VULHUBid:VHN-52714
db:BIDid:51694
db:JVNDBid:JVNDB-2012-001211
db:PACKETSTORMid:109600
db:CNNVDid:CNNVD-201201-352
db:NVDid:CVE-2011-4769

LAST UPDATE DATE
2024-11-23T21:46:32.028000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-52714date:2012-05-13T00:00:00
db:BIDid:51694date:2012-01-26T00:00:00
db:JVNDBid:JVNDB-2012-001211date:2012-01-27T00:00:00
db:CNNVDid:CNNVD-201201-352date:2012-01-31T00:00:00
db:NVDid:CVE-2011-4769date:2024-11-21T01:32:58.307

SOURCES RELEASE DATE
db:VULHUBid:VHN-52714date:2012-01-25T00:00:00
db:BIDid:51694date:2012-01-26T00:00:00
db:JVNDBid:JVNDB-2012-001211date:2012-01-27T00:00:00
db:PACKETSTORMid:109600date:2012-02-09T11:41:09
db:CNNVDid:CNNVD-201201-352date:2012-01-31T00:00:00
db:NVDid:CVE-2011-4769date:2012-01-25T04:03:28.113