A vulnerability was found in Norton App Lock up to 1.3.0.12. It has been rated as critical. This issue affects some unknown processing. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The Norton App Lock prior to version 1.3.0.13 can be susceptible to an authentication bypass exploit. In this type of circumstance, the exploit can allow the user to kill the app to prevent it from locking the device, thereby allowing the individual to gain device access.

The bug was discovered 03/26/2018. The weakness was disclosed 03/26/2018 (Website). The advisory is shared at symantec.com. The identification of this vulnerability is CVE-2017-15534 since 10/17/2017. The exploitation is known to be easy. An attack has to be approached locally. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 1.3.0.13 eliminates this vulnerability.

Productinfo

Vendor

• Norton

Name

• App Lock

Version

• 1.3.0.0
• 1.3.0.1
• 1.3.0.2
• 1.3.0.3
• 1.3.0.4
• 1.3.0.5
• 1.3.0.6
• 1.3.0.7
• 1.3.0.8
• 1.3.0.9
• 1.3.0.10
• 1.3.0.11
• 1.3.0.12

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion