Vulnerability-Lookup

CNVD-2015-04978

Vulnerability from cnvd - Published: 2015-07-28

Title

Android系统备份后还原处理上恶意APK注入漏洞

Description

Android是一种基于Linux的自由及开放源代码的操作系统，主要使用于移动设备，如智能手机和平板电脑，由Google公司和开放手机联盟领导及开发。 Android处理系统备份后还原存在安全漏洞，允许攻击者注入恶意的apk文件到备份文件中。该漏洞是由Android的命令行工具adb的问题导致的，影响目前所有版本的安卓系统(包括Android L)。

Severity

中

Formal description

目前厂商还没有提出此漏洞的相关补丁或升级程序，建议使用此软件的用户随时关注厂商的主页以获得最新版本： https://developers.google.com/android/

Reference

http://www.securityfocus.com/bid/75705

Impacted products

Name
Google Android

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "75705"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2014-7952"
    }
  },
  "description": "Android\u662f\u4e00\u79cd\u57fa\u4e8eLinux\u7684\u81ea\u7531\u53ca\u5f00\u653e\u6e90\u4ee3\u7801\u7684\u64cd\u4f5c\u7cfb\u7edf\uff0c\u4e3b\u8981\u4f7f\u7528\u4e8e\u79fb\u52a8\u8bbe\u5907\uff0c\u5982\u667a\u80fd\u624b\u673a\u548c\u5e73\u677f\u7535\u8111\uff0c\u7531Google\u516c\u53f8\u548c\u5f00\u653e\u624b\u673a\u8054\u76df\u9886\u5bfc\u53ca\u5f00\u53d1\u3002\r\n\r\nAndroid\u5904\u7406\u7cfb\u7edf\u5907\u4efd\u540e\u8fd8\u539f\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u5141\u8bb8\u653b\u51fb\u8005\u6ce8\u5165\u6076\u610f\u7684apk\u6587\u4ef6\u5230\u5907\u4efd\u6587\u4ef6\u4e2d\u3002\u8be5\u6f0f\u6d1e\u662f\u7531Android\u7684\u547d\u4ee4\u884c\u5de5\u5177adb\u7684\u95ee\u9898\u5bfc\u81f4\u7684\uff0c\u5f71\u54cd\u76ee\u524d\u6240\u6709\u7248\u672c\u7684\u5b89\u5353\u7cfb\u7edf(\u5305\u62ecAndroid L)\u3002",
  "discovererName": "SEARCH-LAB Ltd.",
  "formalWay": "\u76ee\u524d\u5382\u5546\u8fd8\u6ca1\u6709\u63d0\u51fa\u6b64\u6f0f\u6d1e\u7684\u76f8\u5173\u8865\u4e01\u6216\u5347\u7ea7\u7a0b\u5e8f\uff0c\u5efa\u8bae\u4f7f\u7528\u6b64\u8f6f\u4ef6\u7684\u7528\u6237\u968f\u65f6\u5173\u6ce8\u5382\u5546\u7684\u4e3b\u9875\u4ee5\u83b7\u5f97\u6700\u65b0\u7248\u672c\uff1a\r\nhttps://developers.google.com/android/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-04978",
  "openTime": "2015-07-28",
  "products": {
    "product": "Google Android"
  },
  "referenceLink": "http://www.securityfocus.com/bid/75705",
  "serverity": "\u4e2d",
  "submitTime": "2015-07-24",
  "title": "Android\u7cfb\u7edf\u5907\u4efd\u540e\u8fd8\u539f\u5904\u7406\u4e0a\u6076\u610fAPK\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2014-7952 (GCVE-0-2014-7952)

Vulnerability from cvelistv5 – Published: 2018-01-12 17:00 – Updated: 2024-08-06 13:03

Summary

The backup mechanism in the adb tool in Android might allow attackers to inject additional applications (APKs) and execute arbitrary code by leveraging failure to filter application data streams.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

6 references

URL	Tags
http://seclists.org/fulldisclosure/2015/Jul/46	mailing-listx_refsource_FULLDISC
http://packetstormsecurity.com/files/132645/ADB-B…	x_refsource_MISC
http://www.search-lab.hu/about-us/news/110-androi…	x_refsource_MISC
https://github.com/irsl/ADB-Backup-APK-Injection/	x_refsource_MISC
http://www.securityfocus.com/bid/75705	vdb-entryx_refsource_BID
http://www.securityfocus.com/archive/1/535980/100…	mailing-listx_refsource_BUGTRAQ

Date Public

2015-07-08 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:03:27.676Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20150710 CVE-2014-7952, Android ADB backup APK injection vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2015/Jul/46"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/132645/ADB-Backup-APK-Injection.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.search-lab.hu/about-us/news/110-android-adb-backup-apk-injection-vulnerability"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/irsl/ADB-Backup-APK-Injection/"
          },
          {
            "name": "75705",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/75705"
          },
          {
            "name": "20150710 CVE-2014-7952, Android ADB backup APK injection vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/535980/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-07-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The backup mechanism in the adb tool in Android might allow attackers to inject additional applications (APKs) and execute arbitrary code by leveraging failure to filter application data streams."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20150710 CVE-2014-7952, Android ADB backup APK injection vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2015/Jul/46"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/132645/ADB-Backup-APK-Injection.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.search-lab.hu/about-us/news/110-android-adb-backup-apk-injection-vulnerability"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/irsl/ADB-Backup-APK-Injection/"
        },
        {
          "name": "75705",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/75705"
        },
        {
          "name": "20150710 CVE-2014-7952, Android ADB backup APK injection vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/535980/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-7952",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The backup mechanism in the adb tool in Android might allow attackers to inject additional applications (APKs) and execute arbitrary code by leveraging failure to filter application data streams."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20150710 CVE-2014-7952, Android ADB backup APK injection vulnerability",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2015/Jul/46"
            },
            {
              "name": "http://packetstormsecurity.com/files/132645/ADB-Backup-APK-Injection.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/132645/ADB-Backup-APK-Injection.html"
            },
            {
              "name": "http://www.search-lab.hu/about-us/news/110-android-adb-backup-apk-injection-vulnerability",
              "refsource": "MISC",
              "url": "http://www.search-lab.hu/about-us/news/110-android-adb-backup-apk-injection-vulnerability"
            },
            {
              "name": "https://github.com/irsl/ADB-Backup-APK-Injection/",
              "refsource": "MISC",
              "url": "https://github.com/irsl/ADB-Backup-APK-Injection/"
            },
            {
              "name": "75705",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/75705"
            },
            {
              "name": "20150710 CVE-2014-7952, Android ADB backup APK injection vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/535980/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-7952",
    "datePublished": "2018-01-12T17:00:00.000Z",
    "dateReserved": "2014-10-07T00:00:00.000Z",
    "dateUpdated": "2024-08-06T13:03:27.676Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2015-04978

CVE-2014-7952 (GCVE-0-2014-7952)

Tags

Sightings

Nomenclature

Related by attack behaviour