Home  >  CVE-2012-2980
CVE Details
ID CVE-2012-2980
Summary The Samsung and HTC onTouchEvent method implementation for Android on the T-Mobile myTouch 3G Slide, HTC Merge, Sprint EVO Shift 4G, HTC ChaCha, AT&T Status, HTC Desire Z, T-Mobile G2, T-Mobile myTouch 4G Slide, and Samsung Galaxy S stores touch coordinates in the dmesg buffer, which allows remote attackers to obtain sensitive information via a crafted application, as demonstrated by PIN numbers, telephone numbers, and text messages.
References
Vulnerable Configurations
  • cpe:2.3:h:htc:merge:-:*:*:*:*:*:*:*
    cpe:2.3:h:htc:merge:-:*:*:*:*:*:*:*
  • cpe:2.3:h:sprint:evo_shift_4g:-:*:*:*:*:*:*:*
    cpe:2.3:h:sprint:evo_shift_4g:-:*:*:*:*:*:*:*
  • cpe:2.3:h:htc:chacha:-:*:*:*:*:*:*:*
    cpe:2.3:h:htc:chacha:-:*:*:*:*:*:*:*
  • cpe:2.3:h:att:status:-:*:*:*:*:*:*:*
    cpe:2.3:h:att:status:-:*:*:*:*:*:*:*
  • cpe:2.3:h:t-mobile:g2:-:*:*:*:*:*:*:*
    cpe:2.3:h:t-mobile:g2:-:*:*:*:*:*:*:*
  • cpe:2.3:h:samsung:galaxy_s:-:*:*:*:*:*:*:*
    cpe:2.3:h:samsung:galaxy_s:-:*:*:*:*:*:*:*
  • cpe:2.3:h:t-mobile:mytouch_3g_slide:-:*:*:*:*:*:*:*
    cpe:2.3:h:t-mobile:mytouch_3g_slide:-:*:*:*:*:*:*:*
  • cpe:2.3:h:htc:desire:-:*:*:*:*:*:*:*
    cpe:2.3:h:htc:desire:-:*:*:*:*:*:*:*
  • cpe:2.3:h:t-mobile:mytouch_4g_slide:-:*:*:*:*:*:*:*
    cpe:2.3:h:t-mobile:mytouch_4g_slide:-:*:*:*:*:*:*:*
CVSS
Base: 7.1 (as of 21-08-2012 - 10:46)
Impact: 6.9
Exploitability:8.6
CWE CWE-255
CAPEC Click the CAPEC title to display a description
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE NONE NONE
cvss-vector via4 AV:N/AC:M/Au:N/C:C/I:N/A:N
refmap via4
cert-vn VU#251635
confirm http://www.kb.cert.org/vuls/id/MAPG-8R5LD6
misc http://www.htc.com/www/help/app-security-fix/
Last major update 21-08-2012 - 10:46
Published 21-08-2012 - 10:46
Last modified 21-08-2012 - 10:46