Dropbox App 98.2.2 Passcode improper authentication ⚔ [Disputed]

Summaryinfo

A vulnerability, which was classified as critical, has been found in Dropbox App 98.2.2. Impacted is an unknown function of the component Passcode Handler. The manipulation leads to improper authentication. This vulnerability is traded as CVE-2018-12446. It is possible to launch the attack on the physical device. There is no exploit available. The actual existence of this vulnerability is currently in question.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Dropbox App 98.2.2 (Cloud Software). This issue affects an unknown functionality of the component Passcode Handler. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

** DISPUTED ** An issue was discovered in the com.dropbox.android application 98.2.2 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred.

The weakness was shared 06/20/2018 (Website). The advisory is shared at gist.github.com. The identification of this vulnerability is CVE-2018-12446 since 06/15/2018. An attack has to be approached locally. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry VDB-119728 is related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Dropbox

Name

• App

Version

• 98.2.2

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion