CVE-2011-1149

2011-04-2110:55:01

CWE-264

[email protected]

web.nvd.nist.gov

android

cve-2011-1149

security

access restriction

system property

sandbox

privilege escalation

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

6.8 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

61.4%

JSON

Android before 2.3 does not properly restrict access to the system property space, which allows local applications to bypass the application sandbox and gain privileges, as demonstrated by psneuter and KillingInTheNameOf, related to the use of Android shared memory (ashmem) and ASHMEM_SET_PROT_MASK.

Affected configurations

NVD

Node

googleandroidRange≤2.2.2

googleandroidMatch1.5

googleandroidMatch1.6

googleandroidMatch2.1

googleandroidMatch2.2rev1

googleandroidMatch2.2.1

CPENameOperatorVersion
google:androidgoogle androidle2.2.2
google:androidgoogle androideq1.5
google:androidgoogle androideq1.6
google:androidgoogle androideq2.1
google:androidgoogle androideq2.2
google:androidgoogle androideq2.2.1

CPE	Name	Operator	Version
google:android	google android	le	2.2.2
google:android	google android	eq	1.5
google:android	google android	eq	1.6
google:android	google android	eq	2.1
google:android	google android	eq	2.2
google:android	google android	eq	2.2.1