JVNDB-2014-000029

sp mode mail vulnerability where Java methods may be executed

sp mode mail provided by NTT DOCOMO contains an issue in the processing Deco-mail emoticon POP, which may lead to the execution of arbitrary Java methods that can be executed with the privileges of sp mode mail.

Hironori Tokuta reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

NTT DOCOMO, INC.

• sp mode mail rev.5900 through rev.6300 for Android 4.0.X and earlier
• sp mode mail rev.6000 (initial version) through rev.6620 for Android 4.1 and later

When a specially crafted email is opened, an arbitrary Java method that can be executed with the privileges of sp mode mail may be executed.

[Update the software]
Update to the latest version according to the information provided by developer.

NTT DOCOMO, INC.

• JVN : Information from NTT DOCOMO, INC.

1. No Mapping(CWE-DesignError) [IPA Evaluation]

1. CVE-2014-1979

1. JVN : JVN#89260331
2. National Vulnerability Database (NVD) : CVE-2014-1979

• [2014/03/18]
    Web page was published
  [2014/03/25]
    References : Content was added