A number of critical security flaws have been disclosed in Samsung’s pre-installed Android apps, which, if successfully exploited, could have authorized adversaries obtain to personalized information with out users’ consent and acquire management of the equipment.
“The effects of these bugs could have allowed an attacker to access and edit the victim’s contacts, calls, SMS/MMS, set up arbitrary applications with device administrator legal rights, or read and produce arbitrary data files on behalf of a procedure user which could change the device’s configurations,” Sergey Toshin, founder of cell security startup Oversecured, stated in an assessment published Thursday.
Toshin noted the flaws to Samsung in February 2021, following which patches had been issued by the company as element of its regular monthly security updates for April and May perhaps. The list of the seven vulnerabilities is as follows –
- CVE-2021-25356 – 3rd-get together authentication bypass in Managed Provisioning
- CVE-2021-25388 – Arbitrary application installation vulnerability in Knox Main
- CVE-2021-25390 – Intent redirection in PhotoTable
- CVE-2021-25391 – Intent redirection in Protected Folder
- CVE-2021-25392 – Feasible to access notification coverage file of DeX
- CVE-2021-25393 – Possible to browse/compose obtain to arbitrary files as a technique person (influences the Configurations app)
- CVE-2021-25397 – Arbitrary file write in TelephonyUI
The impact of these flaws suggests they could be exploited to install arbitrary 3rd-celebration applications, grant the device admin privileges to delete other mounted apps or steal sensitive documents, study or generate arbitrary data files as a system person, and even execute privileged actions.
In a evidence-of-strategy (PoC) demo, Oversecured founded that it was probable to leverage the intent redirection flaws in PhotoTable and Safe Folder to hijack the apps’ permissions to obtain the SD card and read contacts stored in the phone. Similarly, by exploiting CVE-2021-25397 and CVE-2021-25392, an attacker could overwrite the file storing SMS/MMS messages with destructive information and steal knowledge from user notifications.
Samsung gadget owners are advisable to implement the newest firmware updates from the company to keep away from any likely security dangers.
Identified this report appealing? Abide by THN on Facebook, Twitter and LinkedIn to read through more exclusive information we write-up.
Some parts of this article are sourced from:
thehackernews.com