CVSS: 7.5EPSS: 5%CPEs: 8EXPL: 4CVE-2014-0997 – Android WiFi-Direct - Denial of Service
https://notcve.org/view.php?id=CVE-2014-0997
WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used in the Samsung SM-T310, Android 4.1.2 as used in the Motorola RAZR HD, and potentially other unspecified Android releases before 5.0.1 and 5.0.2 does not properly handle exceptions, which allows remote attackers to cause a denial of service (reboot) via a crafted 802.11 probe response frame. WiFiMonitor en Android 4.4.4 tal y como se emplea en Nexus 5 y 4, Android 4.2.2 tal y como se emplea en LG D806, Android 4.2.2 tal y como se emplea en Samsung SM-T310, Android 4.1.2 tal y como se emplea en Motorola RAZR HD y potencialmente en otras distribuciones Android anteriores a la 5.0.1 y 5.0.2 no gestiona correctamente las excepciones. Esto permite que los atacantes remotos provoquen una denegación de servicio (reinicio) mediante un marco de respuesta de sonda 802.11. • https://www.exploit-db.com/exploits/35913 http://packetstormsecurity.com/files/130107/Android-WiFi-Direct-Denial-Of-Service.html http://seclists.org/fulldisclosure/2015/Jan/104 http://www.securityfocus.com/archive/1/534544/100/0/threaded http://www.securityfocus.com/bid/72311 https://www.coresecurity.com/advisories/android-wifi-direct-denial-service • CWE-19: Data Processing Errors •
CVSS: 8.4EPSS: 0%CPEs: 13EXPL: 4CVE-2014-9322 – Linux Kernel - 'BadIRET' Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2014-9322
arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space. arch/x86/kernel/entry_64.S en el kernel de Linux anterior a 3.17.5 no maneja correctamente los fallos asociados con el registro de segmento Stack Segment (SS), lo que permite a usuarios locales ganar privilegios mediante la provocación de una instrucción IRET que lleva al acceso a una dirección de GS Base del espacio equivocado. A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. • https://www.exploit-db.com/exploits/44205 https://www.exploit-db.com/exploits/36266 https://github.com/RKX1209/CVE-2014-9322 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6f442be2fb22be02cafa606f1769fa1e6f894441 http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html http://marc.info/?l= • CWE-269: Improper Privilege Management CWE-841: Improper Enforcement of Behavioral Workflow •
CVSS: 7.2EPSS: 0%CPEs: 45EXPL: 3CVE-2014-7911 – Android CVE-2014-7911 / CVE-2014-4322 Local Exploit
https://notcve.org/view.php?id=CVE-2014-7911
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify that deserialization will result in an object that met the requirements for serialization, which allows attackers to execute arbitrary code via a crafted finalize method for a serialized object in an ArrayMap Parcel within an intent sent to system_service, as demonstrated by the finalize method of android.os.BinderProxy, aka Bug 15874291. luni/src/main/java/java/io/ObjectInputStream.java en la implementación java.io.ObjectInputStream en Android anterior a 5.0.0 no verifica que la deserialización resultará en un objeto que reunió los requisitos para la serialización, lo que permite a atacantes ejecutar código arbitrario a través de un método de finalizar para un objeto serializado en un paquete ArrayMap dentor de un intento enviado a system_service, tal y como fue demostrado por el método de finalizar de android.os.BinderProxy, también conocido como Bug 15874291. • https://github.com/ele7enxxh/CVE-2014-7911 https://github.com/koozxcv/CVE-2014-7911-CVE-2014-4322_get_root_privilege https://github.com/koozxcv/CVE-2014-7911 http://seclists.org/fulldisclosure/2014/Nov/51 https://android.googlesource.com/platform/libcore/+/738c833d38d41f8f76eb7e77ab39add82b1ae1e2 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 45EXPL: 4CVE-2014-8507 – Android WAPPushManager - SQL Injection
https://notcve.org/view.php?id=CVE-2014-8507
Multiple SQL injection vulnerabilities in the queryLastApp method in packages/WAPPushManager/src/com/android/smspush/WapPushManager.java in the WAPPushManager module in Android before 5.0.0 allow remote attackers to execute arbitrary SQL commands, and consequently launch an activity or service, via the (1) wapAppId or (2) contentType field of a PDU for a malformed WAPPush message, aka Bug 17969135. Múltiples vulnerabilidades de inyección SQL en el método queryLastApp en packages/WAPPushManager/src/com/android/smspush/WapPushManager.java en el módulo WAPPushManager en Android anterior a 5.0.0 permiten a atacantes remotos ejecutar comandos SQL arbitrarios, y como consecuencia lanzar una actividad o servicio, a través del campo (1) wapAppId o (2) contentType de un PDU para un mensaje WAPPush malformado, también conocido como Bug 17969135. • https://www.exploit-db.com/exploits/35382 http://packetstormsecurity.com/files/129283/Android-WAPPushManager-SQL-Injection.html http://seclists.org/fulldisclosure/2014/Nov/86 http://www.securityfocus.com/bid/71310 http://xteam.baidu.com/?p=167 https://android.googlesource.com/platform/frameworks/base/+/48ed835468c6235905459e6ef7df032baf3e4df6 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 3.3EPSS: 0%CPEs: 45EXPL: 4CVE-2014-8610 – Android SMS Resend
https://notcve.org/view.php?id=CVE-2014-8610
AndroidManifest.xml in Android before 5.0.0 does not require the SEND_SMS permission for the SmsReceiver receiver, which allows attackers to send stored SMS messages, and consequently transmit arbitrary new draft SMS messages or trigger additional per-message charges from a network operator for old messages, via a crafted application that broadcasts an intent with the com.android.mms.transaction.MESSAGE_SENT action, aka Bug 17671795. AndroidManifest.xml en Android anterior a 5.0.0 no requiere el permiso SEND_SMS para el recibidor SmsReceiver, lo que permite a atacantes remotos enviar mensajes SMS almacenados, y como consecuencia trasmitir nuevos mensajes SMS del borrador o provocar adicionales cobros por mensajes de un operador de la red para mensajes viejos, a través de una aplicación manipulada que emite un intento con la acción com.android.mms.transaction.MESSAGE_SENT, también conocido como Bug 17671795. Android versions prior to 5.0 allow an unprivileged application the ability to resend all the SMS's stored in the users phone. • http://packetstormsecurity.com/files/129282/Android-SMS-Resend.html http://seclists.org/fulldisclosure/2014/Dec/8 http://seclists.org/fulldisclosure/2014/Nov/85 http://xteam.baidu.com/?p=164 https://android.googlesource.com/platform/packages/apps/Mms/+/008d6202fca4002a7dfe333f22377faa73585c67 https://github.com/joswr1ght/drozer-modules/blob/master/whfs/smsdraftsend.py • CWE-264: Permissions, Privileges, and Access Controls •