Lucene search

[email protected]CVE-2020-12717

HistoryMay 14, 2020 - 5:15 a.m.

CVE-2020-12717

2020-05-1405:15:10

[email protected]

web.nvd.nist.gov

covidsafe

ios

remote attack

crash

bluetooth

contact tracing

vulnerability

nvd

cve-2020-12717

3.3 Low

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:N/I:N/A:P

6.5 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.1%

JSON

The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. The ABTraceTogether (Alberta), ProteGO (Poland), and TraceTogether (Singapore) apps were also affected.

Affected configurations

NVD

Node

albertaabtracetogetherMatch-iphone_os

govprotego_safeMatch-iphone_os

healthcovidsafeMatch1.0iphone_os

healthcovidsafeMatch1.1iphone_os

tracetogethertracetogetherMatch-iphone_os

CPENameOperatorVersion
alberta:abtracetogetheralberta abtracetogethereq-
gov:protego_safegov protego safeeq-
health:covidsafehealth covidsafeeq1.0
health:covidsafehealth covidsafeeq1.1
tracetogether:tracetogethertracetogethereq-

CPE	Name	Operator	Version
alberta:abtracetogether	alberta abtracetogether	eq	-
gov:protego_safe	gov protego safe	eq	-
health:covidsafe	health covidsafe	eq	1.0
health:covidsafe	health covidsafe	eq	1.1
tracetogether:tracetogether	tracetogether	eq	-

References

medium.com/%40wabz/covidsafe-ios-vulnerability-cve-2020-12717-30dc003f9708

3.3 Low

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:N/I:N/A:P

6.5 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.1%

JSON

Related for CVE-2020-12717

nvd1 cvelist1 githubexploit1 prion1