Asus ZenFone 3 Max com.asus.dm 7pk security

Summaryinfo

A vulnerability described as critical has been identified in Asus ZenFone 3 Max. The impacted element is an unknown function of the component com.asus.dm. Executing a manipulation can lead to 7pk security. This vulnerability is handled as CVE-2018-14992. It is possible to launch the attack on the local host. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in Asus ZenFone 3 Max (unknown version). This vulnerability affects an unknown code block of the component com.asus.dm. The manipulation with an unknown input leads to a 7pk security vulnerability. The CWE definition for the vulnerability is CWE-254. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contains a pre-installed platform app with a package name of com.asus.dm (versionCode=1510500200, versionName=1.5.0.40_171122) has an exposed interface in an exported service named com.asus.dm.installer.DMInstallerService that allows any app co-located on the device to use its capabilities to download an arbitrary app over the internet and install it. Any app on the device can send an intent with specific embedded data that will cause the com.asus.dm app to programmatically download and install the app. For the app to be downloaded and installed, certain data needs to be provided: download URL, package name, version name from the app's AndroidManifest.xml file, and the MD5 hash of the app. Moreover, any app that is installed using this method can also be programmatically uninstalled using the same unprotected component named com.asus.dm.installer.DMInstallerService.

The bug was discovered 08/05/2018. The weakness was released 12/28/2018 (Website). The advisory is shared for download at kryptowire.com. This vulnerability was named CVE-2018-14992 since 08/05/2018. The attack needs to be approached locally. The requirement for exploitation is a single authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1211.

The vulnerability was handled as a non-public zero-day exploit for at least 145 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-123382, VDB-123383, VDB-123384 and VDB-128470. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Asus

Name

• ZenFone 3 Max

License

• commercial

Website

• Vendor: https://www.asus.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion