A vulnerability was found in Amazon Kindle Touch 5.1.0 (Tablet Operating System). It has been classified as critical. This affects the function com.lab126.system of the component Lab126. The manipulation as part of a Shell Metacharacter leads to a code injection vulnerability. CWE is classifying the issue as CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a string, as demonstrated by using lipc-set-prop to set an LIPC property, a different vulnerability than CVE-2012-4248.

The weakness was disclosed 04/14/2012 by eureka as Scriptable browser plugin included in 5.1.0 as not defined posting (Website). It is possible to read the advisory at mobileread.com. The vendor was not involved in the public release. This vulnerability is uniquely identified as CVE-2012-4249 since 08/12/2012. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a public exploit are known. The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

A public exploit has been developed by eureka in C and been published 5 days after the advisory. The exploit is shared for download at mobileread.com. It is declared as proof-of-concept.

Upgrading to version 5.1.2 eliminates this vulnerability. The problem might be mitigated by replacing the product with Apple iPad as an alternative. The best possible mitigation is suggested to be upgrading to the latest version. A possible mitigation has been published 4 months after the disclosure of the vulnerability. 5.1.2 must be applied over 5.1.0 or 5.1.1. Amongst other changes, 5.1.2 deletes NPAPI plugin /usr/lib/libkindleplugin.so, symlink /usrl/lib/browser/plugins/libkindleplugin.so and directory /usr/lib/browser, thus eliminating possible remote attack vector.

The vulnerability is also documented in the vulnerability database at OSVDB (84902†). Further details are available at kb.cert.org. The entry VDB-61543 is pretty similar. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Tablet Operating System

Vendor

• Amazon

Name

• Kindle Touch

Version

• 5.1.0

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion