[Japanese]

JVNDB-2014-000027

sp mode mail issue when accessing attachments in incoming mail

Overview

sp mode mail provided by NTT DOCOMO contains a function that allows other Android applications to access attachments for incoming emails. This function contains an issue in the restriction of access permissions.

Satoru Takekoshi reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

Base Metrics: 2.6 (Low) [IPA Score]
  • Access Vector: Network
  • Access Complexity: High
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: None
  • Availability Impact: None

Affected Products


NTT DOCOMO, INC.
  • sp mode mail rev.6300 and earlier for Android 4.0.X and earlier
  • sp mode mail rev.6700 and earlier for Android 4.1 and later

Impact

If a malicious Android application is installed on the device, attachments for an incoming email may be obtained.
Solution

An update to address this issue will not be provided by the developer.

[Note on usage]
According to the developer, a warning about this issue has been included in the consent agreement that is displayed when launching the application for the first time in sp mode mail rev.6400 and later for Android 4.0.X and earlier, and sp mode mail rev.6800 and later for Android 4.1 and later.
Vendor Information

NTT DOCOMO, INC.
CWE (What is CWE?)

  1. Permissions(CWE-264) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2014-1977
References

  1. JVN : JVN#81739241
  2. National Vulnerability Database (NVD) : CVE-2014-1977
Revision History

[2014/03/18]
  Web page was published
[2014/03/24]
  References : Content was added