Asus ZenFone 3 com.asus.loguploader permission assignment

Summaryinfo

A vulnerability, which was classified as critical, has been found in Asus ZenFone 3. This issue affects some unknown processing of the component com.asus.loguploader. This manipulation causes permission assignment. The identification of this vulnerability is CVE-2019-15396. The attack can only be executed locally. There is no exploit available.

Detailsinfo

A vulnerability was found in Asus ZenFone 3 (affected version unknown). It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component com.asus.loguploader. The manipulation with an unknown input leads to a permission assignment vulnerability. The CWE definition for the vulnerability is CWE-732. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The Asus ZenFone 3 Android device with a build fingerprint of asus/WW_Phone/ASUS_Z012D:7.0/NRD90M/14.2020.1708.56-20170719:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app (versionCode=1570000015, versionName=7.0.0.3_161222) that allows other pre-installed apps to perform command execution via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.

The weakness was shared 11/14/2019. This vulnerability is known as CVE-2019-15396 since 08/22/2019. The exploitation appears to be easy. Attacking locally is a requirement. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Asus

Name

• ZenFone 3

License

• commercial

Website

• Vendor: https://www.asus.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion