NVD Vulnerability Detail

CVE-2018-14992

Summary	The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contains a pre-installed platform app with a package name of com.asus.dm (versionCode=1510500200, versionName=1.5.0.40_171122) has an exposed interface in an exported service named com.asus.dm.installer.DMInstallerService that allows any app co-located on the device to use its capabilities to download an arbitrary app over the internet and install it. Any app on the device can send an intent with specific embedded data that will cause the com.asus.dm app to programmatically download and install the app. For the app to be downloaded and installed, certain data needs to be provided: download URL, package name, version name from the app's AndroidManifest.xml file, and the MD5 hash of the app. Moreover, any app that is installed using this method can also be programmatically uninstalled using the same unprotected component named com.asus.dm.installer.DMInstallerService.
Publication Date	Dec. 29, 2018, 6:29 a.m.
Registration Date	March 1, 2021, 6:58 p.m.
Last Update	Nov. 21, 2024, 12:50 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:asus:zenfone_3_max_firmware:1.5.0.40:::::::*
execution environment
1	cpe:2.3:h:asus:zenfone_3_max:-:::::::*

Related information, measures and tools

No	URL	タグ
1	https://www.kryptowire.com/portal/android-firmware-defcon-2018/	Vendor Advisory
2	https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf	Exploit Vendor Advisory
3	https://www.kryptowire.com/portal/android-firmware-defcon-2018/	Vendor Advisory
4	https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf	Exploit Vendor Advisory

Common Vulnerabilities List

JVN Vulnerability Information

ASUS ZenFone 3 Max Android デバイスにおけるセキュリティ機能に関する脆弱性

Title	ASUS ZenFone 3 Max Android デバイスにおけるセキュリティ機能に関する脆弱性
Summary	ASUS ZenFone 3 Max Android デバイスには、セキュリティ機能に関する脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Dec. 28, 2018, midnight
Registration Date	March 27, 2019, 1:59 p.m.
Last Update	March 27, 2019, 1:59 p.m.

Affected System

ASUSTeK Computer Inc.

ZenFone 3 Max ファームウェア 1.5.0.40_171122

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-14992	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14992
2	CVE-2018-14992	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14992
National Vulnerability Database (NVD)
3	CVE-2018-14992	https://nvd.nist.gov/vuln/detail/CVE-2018-14992
4	CVE-2018-14992	https://nvd.nist.gov/vuln/detail/CVE-2018-14992

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-254	https://cwe.mitre.org/data/definitions/254.html
2	CWE-254	https://cwe.mitre.org/data/definitions/254.html

ベンダー情報

その他

No	Name	URL
関連文書
1	DEFCON 2018: Vulnerable Out of the Box - An Evaluation of Android Carrier Devices	https://www.kryptowire.com/android-firmware-defcon-2018/
2	DEFCON 2018: Vulnerable Out of the Box - An Evaluation of Android Carrier Devices	https://www.kryptowire.com/android-firmware-defcon-2018/
3	Vulnerable Out of the Box: An Evaluation of Android Carrier Devices	https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf
4	Vulnerable Out of the Box: An Evaluation of Android Carrier Devices	https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf

Change Log

No	Changed Details	Date of change
1	[2019年03月27日] 掲載	March 27, 2019, 1:59 p.m.