Summaryinfo

A vulnerability was found in Google Android 9.0. It has been rated as critical. Affected by this issue is the function SliceBroadcastReceiver of the file AndroidManifest.xml of the component com.android.settings.slice.action.WIFI_CHANGED. The manipulation leads to permission. This vulnerability is referenced as CVE-2018-9525. The attack can only be performed from a local environment. No exploit is available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Google Android 9.0 (Smartphone Operating System). This issue affects the function SliceBroadcastReceiver of the file AndroidManifest.xml of the component com.android.settings.slice.action.WIFI_CHANGED. The manipulation with an unknown input leads to a permission vulnerability. Using CWE to declare the problem leads to CWE-275. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In the AndroidManifest.xml file defining the SliceBroadcastReceiver handler for com.android.settings.slice.action.WIFI_CHANGED, there is a possible permissions bypass due to a confused deputy. This could lead to local escalation of privilege, allowing a local attacker to change device settings, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-111330641

The bug was discovered 11/05/2018. The weakness was published 11/14/2018 (Website). It is possible to read the advisory at source.android.com. The identification of this vulnerability is CVE-2018-9525 since 04/05/2018. Attacking locally is a requirement. The successful exploitation requires a simple authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1222 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 9 days. During that time the estimated underground price was around $25k-$100k. By approaching the search of inurl:AndroidManifest.xml it is possible to find vulnerable targets with Google Hacking.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 105848†). Similar entries are available at VDB-126869, VDB-126870, VDB-126871 and VDB-126872. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 9.0

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion