[Japanese]

JVNDB-2016-000128

Android OS Contacts app fails to restrict access permissions

Overview

The Contacts app within the Android OS contains a vulnerability where it fails to restrict access permissions.

The Contacts app within the Android OS receives requests for outgoing calls through Intents and calls the Dialer app. The Contacts app contains a vulnerability where it fails to restrict access permissions, since it receives and processes Intents from apps without CALL_PHONE permissions.

Shifeng, Zhang of Symantec reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 2.5 (Low) [IPA Score]
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None
CVSS V2 Severity:
Base Metrics 2.6 (Low) [IPA Score]
  • Access Vector: Network
  • Access Complexity: High
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: None
  • Availability Impact: None
Affected Products


Google
  • Android OS versions prior to 4.1.2_r1

Impact

When a user uses a malicious Android app, it may make an unintended outgoing call.
Solution

[Apply an Update]
Apply the update according to the information provided by the developer or distributor.
Vendor Information

KDDI SoftBank Disney Mobile on SoftBank Ymobile Corporation
CWE (What is CWE?)

  1. Permissions(CWE-264) [IPA Evaluation]
CVE (What is CVE?)

References

  1. JVN : JVN#06212291
Revision History

  • [2016/07/25]
      Web page was published

Date Public2016/07/22
Date First Published2016/07/25
Date Last Updated2016/07/25