Lucene search

[email protected]CVE-2012-3887

HistoryJul 26, 2012 - 10:55 p.m.

CVE-2012-3887

2012-07-2622:55:00

CWE-310

[email protected]

web.nvd.nist.gov

airdroid

cve-2012-3887

data transfer

cleartext

base64

encryption

vulnerability

network sniffing

remote attack

6.2 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

55.7%

JSON

AirDroid before 1.0.7 beta uses a cleartext base64 format for data transfer that is documented as an “Encrypted Transmission” feature, which allows remote attackers to obtain sensitive information by sniffing the local wireless network, as demonstrated by the SMS message content sent to the sdctl/sms/send/single/ URI.

CPENameOperatorVersion
airdroid:airdroidairdroideq1.0.4
airdroid:airdroidairdroideq1.0.2
airdroid:airdroidairdroideq1.0.1
airdroid:airdroidairdroidle1.0.6
airdroid:airdroidairdroideq1.0.3
airdroid:airdroidairdroideq1.0.5

CPE	Name	Operator	Version
airdroid:airdroid	airdroid	eq	1.0.4
airdroid:airdroid	airdroid	eq	1.0.2
airdroid:airdroid	airdroid	eq	1.0.1
airdroid:airdroid	airdroid	le	1.0.6
airdroid:airdroid	airdroid	eq	1.0.3
airdroid:airdroid	airdroid	eq	1.0.5

References

archives.neohapsis.com/archives/bugtraq/2012-07/0087.html

www.tele-consulting.com/advisories/TC-SA-2012-02.txt

6.2 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

55.7%

JSON

Related for CVE-2012-3887

prion1 securityvulns2