NVD

Id
17467  
Name
CVE-2016-10137  
Description
An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the com.adups.fota.sysoper app"s AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. This allows a third-party app to read, write, and delete the user"s sent and received text messages and call log. This allows a third-party app to obtain PII from the user without permission to do so.  
Reject
 
CVSS Version
2  
CVSS Score
7.2  
Severity
High  
CVSS Base Score
7.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-03-18  
Published
2017-01-13  
Modified Date
2017-03-15  
Seq
2016-10137  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
96620 17467 CVE-2016-10137 https://www.kryptowire.com/adups_security_analysis.html  View
96621 17467 CVE-2016-10137 https://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.html  View

Related JVN