漏洞标题
N/A
漏洞描述信息
问题在LG设备上使用MTK芯片，具有L(5.0/5.1)、M(6.0/6.0.1)和N(7.0)软件，以及RCA Voyager tablet、BLU Advance 5.0和BLU R1 HD设备上发现了。MTKLogger应用程序，包名com.mediatek.mtklogger，具有任何设备上运行的应用程序可访问的应用组件。这些组件包括com.mediatek.mtklogger.framework.LogReceiver和com.mediatek.mtklogger.framework.MTKLoggerService应用程序组件，因为它们包含 intent 过滤器，不受自定义权限的保护，而且没有明确将 android:exported 属性设置为 false。因此，这些组件默认地被导出，因此可以通过使用 android.content.Intent 对象进行通信，向任何第三方应用程序提供这些组件。这些应用程序组件可以用 embedded 数据启动和停止日志。可用日志是 GPS 日志、调制解调器日志、网络日志和移动日志。包含四种日志类型的根目录是 /sdcard/mtklog，使其对需要读取外部存储权限的应用程序可访问。GPS 日志包含用户的 GPS 坐标以及坐标的时戳。调制解调器日志包含 AT 命令及其参数，允许用户发送和接收通话和短信。网络日志是 tcpdump 网络捕获。移动日志包含 Android 日志，自 Android 4.1 起，该日志对第三方应用程序是不可用的。LG ID是 LVE-SMP-160019。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
An issue was discovered on LG devices using the MTK chipset with L(5.0/5.1), M(6.0/6.0.1), and N(7.0) software, and RCA Voyager Tablet, BLU Advance 5.0, and BLU R1 HD devices. The MTKLogger app with a package name of com.mediatek.mtklogger has application components that are accessible to any application that resides on the device. Namely, the com.mediatek.mtklogger.framework.LogReceiver and com.mediatek.mtklogger.framework.MTKLoggerService application components are exported since they contain an intent filter, are not protected by a custom permission, and do not explicitly set the android:exported attribute to false. Therefore, these components are exported by default and are thus accessible to any third party application by using android.content.Intent object for communication. These application components can be used to start and stop the logs using Intent objects with embedded data. The available logs are the GPS log, modem log, network log, and mobile log. The base directory that contains the directories for the 4 types of logs is /sdcard/mtklog which makes them accessible to apps that require the READ_EXTERNAL_STORAGE permission. The GPS log contains the GPS coordinates of the user as well as a timestamp for the coordinates. The modem log contains AT commands and their parameters which allow the user's outgoing and incoming calls and text messages to be obtained. The network log is a tcpdump network capture. The mobile log contains the Android log, which is not available to third-party apps as of Android 4.1. The LG ID is LVE-SMP-160019.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
多款手机产品信息泄露漏洞
漏洞描述信息
LG、RCA Voyager Tablet、BLU Advance和BLU R1 HD都是手机产品。 LG、RCA Voyager Tablet、BLU Advance 5.0手机和BLU R1 HD手机中存在安全漏洞。攻击者可利用该漏洞执行未授权的操作。
CVSS信息
N/A
漏洞类别
信息泄露