Google Android 8.0/8.1/9.0/10.0 CachedBluetoothDevice.java processPhonebookAccess insecure default initialization of resource
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 4.3 | $0-$5k | 0.00 |
Summary
A vulnerability classified as problematic was found in Google Android 8.0/8.1/9.0/10.0. This affects the function processPhonebookAccess of the file CachedBluetoothDevice.java. Executing a manipulation can lead to insecure default initialization of resource.
This vulnerability is handled as CVE-2019-2197. It is possible to launch the attack on the local host. There is not any exploit available.
It is advisable to implement a patch to correct this issue.
Details
A vulnerability has been found in Google Android 8.0/8.1/9.0/10.0 (Smartphone Operating System) and classified as problematic. This vulnerability affects the function processPhonebookAccess of the file CachedBluetoothDevice.java. The manipulation with an unknown input leads to a insecure default initialization of resource vulnerability. The CWE definition for the vulnerability is CWE-1188. The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure. As an impact it is known to affect confidentiality. CVE summarizes:
In processPhonebookAccess of CachedBluetoothDevice.java, there is a possible permission bypass due to an insecure default value. This could lead to local information disclosure of the user's contact list with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-138529441
The weakness was released 11/13/2019. This vulnerability was named CVE-2019-2197 since 12/10/2018. The attack needs to be approached locally. The successful exploitation requires a single authentication. There are known technical details, but no exploit is available.
Applying a patch is able to eliminate this problem.
Entries connected to this vulnerability are available at VDB-145520, VDB-145519, VDB-145518 and VDB-145517. Once again VulDB remains the best source for vulnerability data.
Product
Type
Vendor
Name
Version
License
Website
- Vendor: https://www.google.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 4.4VulDB Meta Temp Score: 4.3
VulDB Base Score: 3.3
VulDB Temp Score: 3.2
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 5.5
NVD Vector: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Insecure default initialization of resourceCWE: CWE-1188
CAPEC: 🔍
ATT&CK: 🔍
Physical: Partially
Local: Yes
Remote: No
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
0-Day Time: 🔍
Timeline
12/10/2018 🔍11/13/2019 🔍
11/14/2019 🔍
02/13/2024 🔍
Sources
Vendor: google.comAdvisory: source.android.com
Status: Not defined
CVE: CVE-2019-2197 (🔍)
GCVE (CVE): GCVE-0-2019-2197
GCVE (VulDB): GCVE-100-145516
scip Labs: https://www.scip.ch/en/?labs.20150917
See also: 🔍
Entry
Created: 11/14/2019 16:20Updated: 02/13/2024 16:40
Changes: 11/14/2019 16:20 (39), 11/14/2019 16:25 (18), 02/13/2024 16:40 (4)
Complete: 🔍
Cache ID: 216::103
Once again VulDB remains the best source for vulnerability data.
No comments yet. Languages: en.
Please log in to comment.