PT-2020-10911

Name of the Vulnerable Software and Affected Versions SUSE Linux Enterprise Server 15 munge versions prior to 0.5.13-4.3.1 openSUSE Factory munge versions prior to 0.5.13-6.1 Description A Symbolic Link Symlink Following issue in the packaging of munge allowed local attackers to escalate privileg...

Analysing the Attack Surface of an Industrial Data Acquisition Device

Introduction The Data Station Plus from Red Lion Controls was handed to me to analyse the attack surface. The device is designed to connect to SCADA data acquisition devices over Modbus, Profibus, etc. by Serial or Ethernet connection. Data is collected and recorded to a local compact flash card...

Unspecified Vulnerability in Kata M4s

Kata M4s is a smartphone. The com.mediatek.factorymode app in the Kata M4s build fingerprint: alps/fullhct675066n/hct675066n:7.0/NRD90M/1495624556:user/test-keys has a security vulnerability. An attacker could use this vulnerability to make unauthorized changes to wireless settings via other...

Unspecified Vulnerability in Bluboo Bluboo_S1

Bluboo BlubooS1 is a smartphone. The com.mediatek.factorymode app in Bluboo BlubooS1 build fingerprint: BLUBOO/BlubooS1/BlubooS1:7.0/NRD90M/1495809471:user/release-keys A security vulnerability exists. An attacker could use this vulnerability to make unauthorized changes to wireless settings via...

Unspecified Vulnerability in Doogee BL5000

Doogee BL5000 is a smartphone from Doogee, a Chinese company. A security vulnerability exists in the com.mediatek.factorymode app in the Doogee BL5000 build fingerprint: DOOGEE/BL5000/BL5000:7.0/NRD90M/1497072355:user/release-keys. An attacker could use this vulnerability to make unauthorized...

PT-2019-6102

Name of the Vulnerable Software and Affected Versions privoxy versions 3.0.28-lp151.1.1 and prior versions privoxy versions 3.0.28-2.1 and prior versions Description The issue is related to a UNIX Symbolic Link Symlink Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1 and...

Xiaomi Mi Mix 2S Access Control Error Vulnerability (CNVD-2019-41691)

Xiaomi Mi Mix 2S is a smartphone from Chinese company Xiaomi Technology Xiaomi. A vulnerability in the Xiaomi Mi Mix 2S build fingerprint: Xiaomi/polaris/polaris:8.0.0/OPR1.170623.032/V9.5.19.0.ODGMIFA:user/release-keys in the com.huaqin. An access control error vulnerability exists in the factor...

Xiaomi Mi A2 Lite Access Control Error Vulnerability (CNVD-2019-41689)

Xiaomi Mi A2 Lite is a smartphone from Chinese company Xiaomi Technology Xiaomi. The Xiaomi Mi A2 Lite build fingerprint: xiaomi/daisy/daisysprout:9/PKQ1.180917.001/V10.0.3.0.PDLMIXM:user/release-keys in the com.huaqin. An access control error vulnerability exists in the factory app. An attacker...

This Week in Security News: APT33 Botnets Used for Extreme Narrow Targeting and Microsoft’s Patch Tuesday Arrives with A Patch for An IE Zero-Day

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about the APT33 threat group that is using live C&C servers for extremely narrow targeting. Also, read about Trend Micro’s complete...

CVE-2019-15342

The Tecno Camon iAir 2 Plus Android device with a build fingerprint of TECNO/H622/TECNO-ID3k:8.1.0/O11019/E-180914V83:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.11. This app contains an exported service...

CVE-2019-15345

The Tecno Camon iClick Android device with a build fingerprint of TECNO/H633/TECNO-IN6:8.1.0/O11019/A-180409V96:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.8. This app contains an exported service named...

CVE-2019-15344

The Tecno Camon iClick Android device with a build fingerprint of TECNO/H633/TECNO-IN6:8.1.0/O11019/A-180409V96:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.8. This app contains an exported service named...

Input validation

The Coolpad 1851 Android device with a build fingerprint of Coolpad/android/android:8.1.0/O11019/1534834761:userdebug/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.1.13. This app contains an exported service name...

Input validation

The Tecno Camon iClick 2 Android device with a build fingerprint of TECNO/H622/TECNO-ID6:8.1.0/O11019/F-180824V116:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.11. This app contains an exported service...

Input validation

The Tecno Camon iClick Android device with a build fingerprint of TECNO/H633/TECNO-IN6:8.1.0/O11019/A-180409V96:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.8. This app contains an exported service named...

CVE-2019-15389

The Haier A6 Android device with a build fingerprint of Haier/A6/A6:8.1.0/O11019/1534219877:userdebug/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.1.13. This app contains an exported service named...

CVE-2019-15348

The Tecno Camon Android device with a build fingerprint of TECNO/H612/TECNO-ID5a:8.1.0/O11019/F-180828V106:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.11. This app contains an exported service named...

CVE-2019-15348

CVE-2019-15348 affects Tecno Camon Android devices that include a pre-installed platform app com.lovelyfont.defcontainer (FontCoverService). The exported service allows any co-located app to pass arbitrary shell-script commands to be executed as the system user when triggered via a logcat message...

CVE-2019-15346

The Tecno Camon iClick 2 Android device with a build fingerprint of TECNO/H622/TECNO-ID6:8.1.0/O11019/F-180824V116:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.11. This app contains an exported service...

xHelper Malware for Android

xHelper is not interesting because of its infection mechanism; the user has to side-load an app onto his phone. It's not interesting because of its payload; it seems to do nothing more than show unwanted ads. it's interesting because of its persistence: Furthermore, even if users spot the xHelper...