Lucene search

CertccCVE-2012-2980

HistoryAug 21, 2012 - 10:46 a.m.

CVE-2012-2980

2012-08-2110:46:10

CWE-255

certcc

web.nvd.nist.gov

samsung

htc

android

ontouchevent

dmesg buffer

information disclosure

cve-2012-2980

nvd

CVSS2

7.1

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:C/I:N/A:N

AI Score

6.2

Confidence

Low

EPSS

0.004

Percentile

74.2%

JSON

The Samsung and HTC onTouchEvent method implementation for Android on the T-Mobile myTouch 3G Slide, HTC Merge, Sprint EVO Shift 4G, HTC ChaCha, AT&T Status, HTC Desire Z, T-Mobile G2, T-Mobile myTouch 4G Slide, and Samsung Galaxy S stores touch coordinates in the dmesg buffer, which allows remote attackers to obtain sensitive information via a crafted application, as demonstrated by PIN numbers, telephone numbers, and text messages.

Affected configurations

Nvd

Node

attstatusMatch-

htcchachaMatch-

htcdesireMatch-

htcmergeMatch-

samsunggalaxy_sMatch-

sprintevo_shift_4gMatch-

t-mobileg2Match-

t-mobilemytouch_3g_slideMatch-

t-mobilemytouch_4g_slideMatch-

VendorProductVersionCPE
attstatus-cpe:2.3:h:att:status:-:*:*:*:*:*:*:*
htcchacha-cpe:2.3:h:htc:chacha:-:*:*:*:*:*:*:*
htcdesire-cpe:2.3:h:htc:desire:-:*:*:*:*:*:*:*
htcmerge-cpe:2.3:h:htc:merge:-:*:*:*:*:*:*:*
samsunggalaxy_s-cpe:2.3:h:samsung:galaxy_s:-:*:*:*:*:*:*:*
sprintevo_shift_4g-cpe:2.3:h:sprint:evo_shift_4g:-:*:*:*:*:*:*:*
t-mobileg2-cpe:2.3:h:t-mobile:g2:-:*:*:*:*:*:*:*
t-mobilemytouch_3g_slide-cpe:2.3:h:t-mobile:mytouch_3g_slide:-:*:*:*:*:*:*:*
t-mobilemytouch_4g_slide-cpe:2.3:h:t-mobile:mytouch_4g_slide:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
att	status	-	cpe:2.3:h:att:status:-:::::::*
htc	chacha	-	cpe:2.3:h:htc:chacha:-:::::::*
htc	desire	-	cpe:2.3:h:htc:desire:-:::::::*
htc	merge	-	cpe:2.3:h:htc:merge:-:::::::*
samsung	galaxy_s	-	cpe:2.3:h:samsung:galaxy_s:-:::::::*
sprint	evo_shift_4g	-	cpe:2.3:h:sprint:evo_shift_4g:-:::::::*
t-mobile	g2	-	cpe:2.3:h:t-mobile:g2:-:::::::*
t-mobile	mytouch_3g_slide	-	cpe:2.3:h:t-mobile:mytouch_3g_slide:-:::::::*
t-mobile	mytouch_4g_slide	-	cpe:2.3:h:t-mobile:mytouch_4g_slide:-:::::::*

References

www.htc.com/www/help/app-security-fix/

www.kb.cert.org/vuls/id/251635

www.kb.cert.org/vuls/id/MAPG-8R5LD6

CVSS2

7.1

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:C/I:N/A:N

AI Score

6.2

Confidence

Low

EPSS

0.004

Percentile

74.2%

JSON

Related for CVE-2012-2980