CVE-2018-15004 Information disclosure in n/a
An exported service in a Qualcomm modem test app allows any app to enable system logging, exposing sensitive data like SMS and network traffic to external storage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-15004?
CVE-2018-15004 is a medium-severity vulnerability in n/a, published on 28 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Coolpad Canvas device with a build fingerprint of Coolpad/cp3636a/cp3636a:7.0/NRD90M/093031423:user/release-keys contains a platform app with a package name of com.qualcomm.qti.modemtestmode (versionCode=24, versionName=7.0) that contains an exported service app component named com.qualcomm.qti.modemtestmode.MbnTestService that allows any app on the device to set certain system properties as the com.android.phone user. When an app sets the persist.service.logr.enable system property to a value of 1, an app with a package name of com.yulong.logredirect (versionCode=20160622, versionName=5.25_20160622_01) will start writing the system-wide logcat log, kernel log, and a tcpdump network traffic capture to external storage. Furthermore, on the Coolpad Canvas device, the com.android.phone app writes the destination phone number and body of the text message for outgoing text messages. A notification when logging can be avoided if the log is enabled after device startup and disabled prior to device shutdown by setting the system properties using the exported interface of the com.qualcomm.qti.modemtestmode app. Any app with the READ_EXTERNAL_STORAGE permission can access the log files.
Weakness: CWE-532
Which versions are affected by CVE-2018-15004?
It affects 1 product.
Products include Coolpad Canvas Firmware.
How do I fix CVE-2018-15004?
No fix has been published for CVE-2018-15004 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-15004 being exploited?
There is no known exploitation of CVE-2018-15004 in the wild and no public exploit code.
Sources
Also known as GHSA-q8p7-w3vh-wg45.