MoboTap Dolphin Browser 12.0.2 on Android Backup/Restore Backup File input validation

Summaryinfo

A vulnerability marked as problematic has been reported in MoboTap Dolphin Browser 12.0.2 on Android. This issue affects some unknown processing of the component Backup/Restore. Performing a manipulation as part of Backup File results in input validation. This vulnerability is cataloged as CVE-2017-17551. The attack must be initiated from a local position. There is no exploit available.

Detailsinfo

A vulnerability was found in MoboTap Dolphin Browser 12.0.2 on Android (Social Network Software). It has been classified as problematic. This affects an unknown code of the component Backup/Restore. The manipulation as part of a Backup File leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The Backup and Restore feature in Mobotap Dolphin Browser for Android 12.0.2 suffers from an arbitrary file write vulnerability when attempting to restore browser settings from a malicious Dolphin Browser backup file. This arbitrary file write vulnerability allows an attacker to overwrite a specific executable in the Dolphin Browser's data directory with a crafted malicious executable. Every time the Dolphin Browser is launched, it will attempt to run the malicious executable from disk, thus executing the attacker's code.

The bug was discovered 12/12/2017. The weakness was shared 12/11/2017 (Website). It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2017-17551 since 12/11/2017. Attacking locally is a requirement. A authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry VDB-110500 is related to this item. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Social Network Software

Vendor

• MoboTap

Name

• Dolphin Browser

Version

• 12.0.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion