Lucene search

[email protected]CVE-2011-4872

HistoryFeb 05, 2012 - 11:55 a.m.

CVE-2011-4872

2012-02-0511:55:00

CWE-200

[email protected]

web.nvd.nist.gov

cve-2011-4872

htc

android devices

wi-fi

credential leakage

remote attack

nvd

6.8 Medium

AI Score

Confidence

Low

2.6 Low

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

71.7%

JSON

Multiple HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40, and EVO 4G GRI40 allow remote attackers to obtain 802.1X Wi-Fi credentials and SSID via a crafted application that uses the android.permission.ACCESS_WIFI_STATE permission to call the toString method on the WifiConfiguration class.

CPENameOperatorVersion
htc:glacierhtc glaciereqfrg83
htc:sensation_z710ehtc sensation z710eeqgri40
htc:evo_3dhtc evo 3deqgri40
htc:desire_shtc desire seqgri40
htc:desire_hdhtc desire hdeqgri40
htc:sensation_4ghtc sensation 4geqgri40
htc:desire_hdhtc desire hdeqfrg83d
htc:thunderbolt_4ghtc thunderbolt 4geqfrg83d
htc:evo_4ghtc evo 4geqgri40
htc:droid_incrediblehtc droid incredibleeqfrf91

CPE	Name	Operator	Version
htc:glacier	htc glacier	eq	frg83
htc:sensation_z710e	htc sensation z710e	eq	gri40
htc:evo_3d	htc evo 3d	eq	gri40
htc:desire_s	htc desire s	eq	gri40
htc:desire_hd	htc desire hd	eq	gri40
htc:sensation_4g	htc sensation 4g	eq	gri40
htc:desire_hd	htc desire hd	eq	frg83d
htc:thunderbolt_4g	htc thunderbolt 4g	eq	frg83d
htc:evo_4g	htc evo 4g	eq	gri40
htc:droid_incredible	htc droid incredible	eq	frf91

References

archives.neohapsis.com/archives/bugtraq/2012-02/0002.html

blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html

secunia.com/advisories/47837

www.kb.cert.org/vuls/id/763355

www.securityfocus.com/bid/51790

6.8 Medium

AI Score

Confidence

Low

2.6 Low

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

71.7%

JSON

Related for CVE-2011-4872

cvelist1 cert1 prion1