Published: 20/02/2020 Updated: 07/11/2023

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

CVSS v3 Base Score: 4.6 | Impact Score: 3.6 | Exploitability Score: 0.9

VMScore: 215

Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N

Directory traversal vulnerability in the Android debug bridge (aka adb) in Android 4.0.4 allows physically proximate attackers with a direct connection to the target Android device to write to arbitrary files owned by system via a .. (dot dot) in the tar archive headers.

Vulnerable Product	Search on Vulmon	Subscribe to Product
google android 4.0.4

ADB backup archive path traversal file overwrite ------------------------------------------------ Using adb one can create a backup of his/her Android device and store it on the PC The backup archive is based on the tar file format By modifying tar headers to contain // like patterns it is possible to overwrite files owned by the system ...

The Android backup agent implementation was vulnerable to privilege escalation and race condition An attacker with adb shell access could run arbitrary code as the system (1000) user (or any other valid package) The attack is tested on Android OS 444 ...

ADB backup on Android version 404 allows for file overwrite via modified tar headers ...

Just an attempt to adapt for Note 4, I do not know what I am doing.

CVE-2014-4322_adaptation Just an attempt to adapt for Note 4, I do not know what I am doing There is currently a way to write to system using ADB (CVE-2014-7951 and CVE-2014-7953) zxz0O0 has confirmed writing to system works What we needed was to gain System UID to execute CVE-2014-4322 I am looking at how CVE-2014-4322 works to see if I could wrap it in an APK which may al

CWE-22 http://www.securityfocus.com/bid/74211 http://packetstormsecurity.com/files/131510/ADB-Backup-Traversal-File-Overwrite.html http://seclists.org/fulldisclosure/2015/Apr/51 https://www.exploit-db.com/exploits/36813/https://android.googlesource.com/platform/frameworks/base/+/7bc601d%5E%21/#F0 https://nvd.nist.gov https://github.com/askk/CVE-2014-4322_adaptation https://www.exploit-db.com/exploits/36813/

CVE-2014-7951

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect