Google Android 8.0/8.1/9.0 TvProvider.java createProjectionMapForQuery sql injection

Summaryinfo

A vulnerability classified as critical has been found in Google Android 8.0/8.1/9.0. Affected is the function createProjectionMapForQuery of the file TvProvider.java. The manipulation leads to sql injection. This vulnerability is traded as CVE-2019-2211. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in Google Android 8.0/8.1/9.0 (Smartphone Operating System). It has been rated as critical. This issue affects the function createProjectionMapForQuery of the file TvProvider.java. The manipulation with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In createProjectionMapForQuery of TvProvider.java, there is possible SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-135269669

The weakness was shared 11/13/2019. The identification of this vulnerability is CVE-2019-2211 since 12/10/2018. The attack may be initiated remotely. Required for exploitation is a simple authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 02/13/2024). It is expected to see the exploit prices for this product increasing in the near future.MITRE ATT&CK project uses the attack technique T1505 for this issue.

Applying a patch is able to eliminate this problem.

The entries VDB-145533, VDB-145532, VDB-145531 and VDB-145530 are related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 8.0
• 8.1
• 9.0

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion