漏洞标题
N/A
漏洞描述信息
在 Shanghai Adups 软件下的 BLU Advance 5.0 和 BLU R1 HD 设备上发现了一个问题。com.adups.fota.sysoper 应用程序被安装作为系统应用程序，无法由用户禁用。在 com.adups.fota.sysoper 应用程序的AndroidManifest.xml 文件中，它将 android:sharedUserId 属性设置为 android.uid.system，使其执行方式变为系统用户，这是设备上非常特权的用户。该应用程序有一个导出广播接收器名为 com.adups.fota.sysoper.WriteCommandReceiver，可以与任何应用程序交互。因此，任何应用程序都可以在 intent 中嵌入命令，该命令将由执行方式为系统用户的 WriteCommandReceiver 组件执行。使用 WriteCommandReceiver 的第三方应用程序可以实现以下操作：拨打电话号码、重启设备、拍照屏幕、录制屏幕视频、安装应用程序、注入事件、获取 Android 日志等。此外，com.adups.fota.sysoper.TaskService 组件将向http://rebootv5.adsunflower.com/ps/fetch.do URL 发送请求，其中服务器返回的 JSON 对象中 String 数组sf中的命令将作为系统用户执行。由于该连接通过 HTTP 实现，因此容易受到 MITM 攻击。
CVSS信息
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
An issue was discovered on BLU Advance 5.0 and BLU R1 HD devices with Shanghai Adups software. The com.adups.fota.sysoper app is installed as a system app and cannot be disabled by the user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. The app has an exported broadcast receiver named com.adups.fota.sysoper.WriteCommandReceiver which any app on the device can interact with. Therefore, any app can send a command embedded in an intent which will be executed by the WriteCommandReceiver component which is executing as the system user. The third-party app, utilizing the WriteCommandReceiver, can perform the following actions: call a phone number, factory reset the device, take pictures of the screen, record the screen in a video, install applications, inject events, obtain the Android log, and others. In addition, the com.adups.fota.sysoper.TaskService component will make a request to a URL of http://rebootv5.adsunflower.com/ps/fetch.do where the commands in the String array with a key of sf in the JSON Object sent back by the server will be executed as the system user. Since the connection is made via HTTP, it is vulnerable to a MITM attack.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
BLU Advance和BLU R1 HD 加密问题漏洞
漏洞描述信息
BLU Advance和BLU R1 HD都是美国BLU公司的智能手机产品。 BLU Advance 5.0版本和BLU R1 HD设备中存在安全漏洞。攻击者可利用该漏洞实施MITM攻击。
CVSS信息
N/A
漏洞类别
加密问题