CVE-2012-2217 Missing authorization in n/a
Remote attackers can send SMS, steal credentials, or trigger UI elements via a malicious app exploiting unrestricted localhost access in HTC IQRD service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2012-2217?
CVE-2012-2217 is a medium-severity missing authorization vulnerability in n/a, published on 1 May 2012. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The HTC IQRD service for Android on the HTC EVO 4G before 4.67.651.3, EVO Design 4G before 2.12.651.5, Shift 4G before 2.77.651.3, EVO 3D before 2.17.651.5, EVO View 4G before 2.23.651.1, Vivid before 3.26.502.56, and Hero does not restrict localhost access to TCP port 2479, which allows remote attackers to (1) send SMS messages, (2) obtain the Network Access Identifier (NAI) and its password, or trigger (3) popup messages or (4) tones via a crafted application that leverages the android.permission.INTERNET permission.
Weakness: CWE-264
Which versions are affected by CVE-2012-2217?
It affects 14 products.
Products include Htc Evo 3d, Htc Evo 3d Software, Htc Evo 4g, Htc Evo 4g Software, Htc Evo Design 4g, Htc Evo Design 4g Software and 8 more.
How do I fix CVE-2012-2217?
No fix has been published for CVE-2012-2217 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2012-2217 being exploited?
There is no known exploitation of CVE-2012-2217 in the wild and no public exploit code.
Sources
Also known as GHSA-w7x7-pv7g-c83h.