CVE-2015-3860 Detail
Current Description
packages/Keyguard/res/layout/keyguard_password_view.xml in Lockscreen in Android 5.x before 5.1.1 LMY48M does not restrict the number of characters in the passwordEntry input field, which allows physically proximate attackers to bypass intended access restrictions via a long password that triggers a SystemUI crash, aka internal bug 22214934.
Source:
MITRE
View Analysis Description
Analysis Description
packages/Keyguard/res/layout/keyguard_password_view.xml in Lockscreen in Android 5.x before 5.1.1 LMY48M does not restrict the number of characters in the passwordEntry input field, which allows physically proximate attackers to bypass intended access restrictions via a long password that triggers a SystemUI crash, aka internal bug 22214934.
Source:
MITRE
Impact
CVSS v2.0 Severity and Metrics:
Base Score:
7.2 HIGH
Vector:
(AV:L/AC:L/Au:N/C:C/I:C/A:C)
(V2 legend)
Impact Subscore:
10.0
Exploitability Subscore:
3.9
Access Vector (AV):
Local
Access Complexity (AC):
Low
Authentication (AU):
None
Confidentiality (C):
Complete
Integrity (I):
Complete
Availability (A):
Complete
Additional Information:
Allows unauthorized disclosure of information
Allows unauthorized modification
Allows disruption of service
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because
they may have information that would be of interest to you. No inferences should be drawn on account of other sites
being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose.
NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further,
NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about
this page to nvd@nist.gov.
Change History
3 change records found
- show changes
CVE Translated -
10/3/2015 2:45:02 AM
| Action |
Type |
Old Value |
New Value |
| Added |
Translation |
|
packages/Keyguard/res/layout/keyguard_password_view.xml en Lockscreen en Android 5.x en versiones anteriores a 5.1.1 LMY48M no restringe el número de caracteres en el campo de entrada passwordEntry, lo que permite a atacantes próximos físicamente eludir las restricciones destinadas al acceso a través de una contraseña larga que desencadena una caída de SystemUI, también conocido como error interno 22214934. |
| Removed |
Translation |
Record truncated, showing 500 of 506 characters.
View Entire Change Record
Vulnerabilidad en packages/Keyguard/res/layout/keyguard_password_view.xml en Lockscreen en Android 5.x en versiones anteriores a 5.1.1 LMY48M, no restringe el número de caracteres en el campo de entrada passwordEntry, lo que permite a atacantes próximos físicamente eludir las restricciones destinadas al acceso a través de una contraseña larga que desencadena una caída de SystemUI, también conocida como error interno 222 |
|
Modified Analysis -
10/1/2015 2:08:05 PM
| Action |
Type |
Old Value |
New Value |
| Added |
CPE Configuration |
|
Configuration 1
OR
*cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:* (and previous) |
| Added |
CVSS V2 |
|
(AV:L/AC:L/Au:N/C:C/I:C/A:C) |
| Added |
CWE |
|
CWE-284 |
| Changed |
Reference Type |
http://sites.utexas.edu/iso/2015/09/15/android-5-lockscreen-bypass/ No Types Assigned |
http://sites.utexas.edu/iso/2015/09/15/android-5-lockscreen-bypass/ Exploit |
| Changed |
Reference Type |
https://android.googlesource.com/platform/frameworks/base/+/8fba7e6931245a17215e0e740e78b45f6b66d590 No Types Assigned |
https://android.googlesource.com/platform/frameworks/base/+/8fba7e6931245a17215e0e740e78b45f6b66d590 Advisory |
| Changed |
Reference Type |
https://code.google.com/p/android/issues/detail?id=178139 No Types Assigned |
https://code.google.com/p/android/issues/detail?id=178139 Exploit |
| Changed |
Reference Type |
https://groups.google.com/forum/message/raw?msg=android-security-updates/1M7qbSvACjo/Y7jewiW1AwAJ No Types Assigned |
https://groups.google.com/forum/message/raw?msg=android-security-updates/1M7qbSvACjo/Y7jewiW1AwAJ Advisory |
Initial CVE Analysis -
10/1/2015 11:11:13 AM
Quick Info
CVE Dictionary Entry:
CVE-2015-3860
NVD Published Date:
09/30/2015
NVD Last Modified:
10/01/2015
|