Sign-up

ID

VAR-201812-0116


CVE

CVE-2018-15004


TITLE

Coolpad Canvas Vulnerability related to information disclosure from log files on devices

Trust: 0.8

sources: JVNDB: JVNDB-2018-014389

DESCRIPTION

The Coolpad Canvas device with a build fingerprint of Coolpad/cp3636a/cp3636a:7.0/NRD90M/093031423:user/release-keys contains a platform app with a package name of com.qualcomm.qti.modemtestmode (versionCode=24, versionName=7.0) that contains an exported service app component named com.qualcomm.qti.modemtestmode.MbnTestService that allows any app on the device to set certain system properties as the com.android.phone user. When an app sets the persist.service.logr.enable system property to a value of 1, an app with a package name of com.yulong.logredirect (versionCode=20160622, versionName=5.25_20160622_01) will start writing the system-wide logcat log, kernel log, and a tcpdump network traffic capture to external storage. Furthermore, on the Coolpad Canvas device, the com.android.phone app writes the destination phone number and body of the text message for outgoing text messages. A notification when logging can be avoided if the log is enabled after device startup and disabled prior to device shutdown by setting the system properties using the exported interface of the com.qualcomm.qti.modemtestmode app. Any app with the READ_EXTERNAL_STORAGE permission can access the log files. Coolpad Canvas The device contains a vulnerability related to information disclosure from log files.Information may be obtained. Coolpad Canvas is a smart phone based on Android platform of China Coolpad Group Company. com.qualcomm.qti.modemtestmode of the com.qualcomm.qti.modemtestmode packet of the platform application in Coolpad Canvas (the Build fingerprint used is Coolpad/cp3636a/cp3636a:7.0/NRD90M/093031423:user/release-keys) A security vulnerability exists in the .MbnTestService application component. An attacker could exploit this vulnerability to set system properties as the com.android.phone user

Trust: 1.71

sources: NVD: CVE-2018-15004 // JVNDB: JVNDB-2018-014389 // VULHUB: VHN-125220

AFFECTED PRODUCTS

vendor:coolpadmodel:canvasscope:eqversion:7.0

Trust: 1.8

sources: JVNDB: JVNDB-2018-014389 // NVD: CVE-2018-15004

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-15004
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-15004
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201812-1257
value: MEDIUM

Trust: 0.6

VULHUB: VHN-125220
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-15004
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-125220
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-15004
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.2
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-125220 // JVNDB: JVNDB-2018-014389 // CNNVD: CNNVD-201812-1257 // NVD: CVE-2018-15004

PROBLEMTYPE DATA

problemtype:CWE-532

Trust: 1.9

sources: VULHUB: VHN-125220 // JVNDB: JVNDB-2018-014389 // NVD: CVE-2018-15004

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201812-1257

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-014389

PATCH
title:Coolpad Canvasurl:http://store.coolpad.us/product/coolpad-canvas/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2018-014389

EXTERNAL IDS
db:NVDid:CVE-2018-15004
Trust: 2.5
db:JVNDBid:JVNDB-2018-014389
Trust: 0.8
db:CNNVDid:CNNVD-201812-1257
Trust: 0.7
db:VULHUBid:VHN-125220
Trust: 0.1
sources:
            
            
            VULHUB: VHN-125220 // 
            
            
            
            JVNDB: JVNDB-2018-014389 // 
            
            
            
            CNNVD: CNNVD-201812-1257 // 
            
            
            
            NVD: CVE-2018-15004

REFERENCES
url:https://www.kryptowire.com/portal/android-firmware-defcon-2018/
Trust: 2.5
url:https://www.kryptowire.com/portal/wp-content/uploads/2018/12/defcon-26-johnson-and-stavrou-vulnerable-out-of-the-box-an-eval-of-android-carrier-devices-wp-updated.pdf
Trust: 2.5
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-15004
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-15004
Trust: 0.8
sources:
            
            
            VULHUB: VHN-125220 // 
            
            
            
            JVNDB: JVNDB-2018-014389 // 
            
            
            
            CNNVD: CNNVD-201812-1257 // 
            
            
            
            NVD: CVE-2018-15004

SOURCES
db:VULHUBid:VHN-125220
db:JVNDBid:JVNDB-2018-014389
db:CNNVDid:CNNVD-201812-1257
db:NVDid:CVE-2018-15004

LAST UPDATE DATE
2024-11-23T22:34:04.649000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-125220date:2019-02-07T00:00:00
db:JVNDBid:JVNDB-2018-014389date:2019-03-19T00:00:00
db:CNNVDid:CNNVD-201812-1257date:2019-02-13T00:00:00
db:NVDid:CVE-2018-15004date:2024-11-21T03:50:19.980

SOURCES RELEASE DATE
db:VULHUBid:VHN-125220date:2018-12-28T00:00:00
db:JVNDBid:JVNDB-2018-014389date:2019-03-19T00:00:00
db:CNNVDid:CNNVD-201812-1257date:2018-12-29T00:00:00
db:NVDid:CVE-2018-15004date:2018-12-28T21:29:00.900