CVE-2014-1978

The application link interface in the NTT DOCOMO sp mode mail application 6100 through 6300 for Android 4.0.x and 6130 through 6700 for Android 4.1 through 4.4 writes message content to the SD card during e-mail composition, which allows attackers to obtain sensitive information via a crafted application.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://jvn.jp/en/jp/JVN05951929/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000028

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:nttdocomo:spmode_mail_android:6100:::::android::
	cpe:2.3:a:nttdocomo:spmode_mail_android:6300:::::android::

OR	cpe:2.3:o:google:android:4.0:::::::*
	cpe:2.3:o:google:android:4.0.1:::::::*
	cpe:2.3:o:google:android:4.0.2:::::::*
	cpe:2.3:o:google:android:4.0.3:::::::*
	cpe:2.3:o:google:android:4.0.4:::::::*

Configuration 2 (hide)

AND

OR	cpe:2.3:a:nttdocomo:spmode_mail_android:6130:::::android::
	cpe:2.3:a:nttdocomo:spmode_mail_android:6700:::::android::

OR	cpe:2.3:o:google:android:4.1:::::::*
	cpe:2.3:o:google:android:4.1.2:::::::*
	cpe:2.3:o:google:android:4.2:::::::*
	cpe:2.3:o:google:android:4.2.1:::::::*
	cpe:2.3:o:google:android:4.2.2:::::::*
	cpe:2.3:o:google:android:4.3:::::::*
	cpe:2.3:o:google:android:4.3.1:::::::*
	cpe:2.3:o:google:android:4.4:::::::*

History

No history.

Information

Published : 2014-03-19 14:17

Updated : 2023-12-10 11:31

NVD link : CVE-2014-1978

Mitre link : CVE-2014-1978

CVE.ORG link : CVE-2014-1978

JSON object : View

Products Affected

google

android

nttdocomo

spmode_mail_android

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2014-1978", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-03-19T14:17:45.103", "references": [{"url": "http://jvn.jp/en/jp/JVN05951929/index.html", "source": "vultures@jpcert.or.jp"}, {"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000028", "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The application link interface in the NTT DOCOMO sp mode mail application 6100 through 6300 for Android 4.0.x and 6130 through 6700 for Android 4.1 through 4.4 writes message content to the SD card during e-mail composition, which allows attackers to obtain sensitive information via a crafted application."}, {"lang": "es", "value": "La interfaz de enlace de aplicaci\u00f3n en la aplicaci\u00f3n de correo NTT DOCOMO sp mode 6100 hasta 6300 para Android 4.0.x y 6130 hasta 6700 para Android 4.1 hasta 4.4 escribe contenido de mensajes en la tarjeta SD durante la composici\u00f3n de email, lo que permite a atacantes obtener informaci\u00f3n sensible a trav\u00e9s de una aplicaci\u00f3n manipulada."}], "lastModified": "2014-03-20T16:02:34.990", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nttdocomo:spmode_mail_android:6100:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "4B2B7E7F-9D73-42B8-BC76-33D7243024F2"}, {"criteria": "cpe:2.3:a:nttdocomo:spmode_mail_android:6300:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "D24242AD-2016-488F-9FC9-76210F05B861"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A39C31E3-75C0-4E92-A6B5-7D67B22E3449"}, {"criteria": "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BB318EA4-2908-4B91-8DBB-20008FDF528A"}, {"criteria": "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1F4E46A9-B652-47CE-92E8-01021E57724B"}, {"criteria": "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AB9B53C6-AE84-4A45-B83E-8E5CE44F7B93"}, {"criteria": "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "36DD8E3F-6308-4680-B932-4CBD8E58A7FB"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nttdocomo:spmode_mail_android:6130:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "266A416B-CD5B-4621-A311-6E42EC2FB88F"}, {"criteria": "cpe:2.3:a:nttdocomo:spmode_mail_android:6700:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "9F62E0A1-3F6D-41A1-B0F8-E57026A67B26"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1DA9F0F7-D592-481E-884C-B1A94E702825"}, {"criteria": "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6CD857E7-B878-49F9-BDDA-93DDEBB0B42B"}, {"criteria": "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FBDABB6C-FFF9-4E79-9EF1-BDC0BBDEA9F1"}, {"criteria": "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A47AB858-36DE-4330-8CAC-1B46C5C8DA80"}, {"criteria": "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "49413FF7-7910-4F74-B106-C3170612CB2A"}, {"criteria": "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2467F65-A3B7-4E45-A9A5-E5A6EFD99D7B"}, {"criteria": "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A8882E50-7C49-4A99-91F2-DF979CF8BB2F"}, {"criteria": "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "98C32982-095C-4628-9958-118A3D3A9CAA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "vultures@jpcert.or.jp"}