NVD Vulnerability Detail

CVE-2018-15001

Summary	The Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys contains a platform app with a package name of com.vivo.bsptest (versionCode=1, versionName=1.0) containing an exported activity app component named com.vivo.bsptest.BSPTestActivity that allows any app co-located on the device to initiate the writing of the logcat log, bluetooth log, and kernel log to external storage. When logging is enabled, there is a notification in the status bar, so it is not completely transparent to the user. The user can cancel the logging, but it can be re-enabled since the app with a package name of com.vivo.bsptest cannot be disabled. The writing of these logs can be initiated by an app co-located on the device, although the READ_EXTERNAL_STORAGE permission is necessary to for an app to access the log files.
Publication Date	Dec. 29, 2018, 6:29 a.m.
Registration Date	March 1, 2021, 6:58 p.m.
Last Update	Nov. 21, 2024, 12:50 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	https://www.kryptowire.com/portal/android-firmware-defcon-2018/	Third Party Advisory
2	https://www.kryptowire.com/portal/android-firmware-defcon-2018/	Third Party Advisory
3	https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf	Exploit Third Party Advisory
4	https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf	Exploit Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-532	ログファイルからの情報漏えい	https://cwe.mitre.org/data/definitions/532.html

JVN Vulnerability Information

Vivo V7 Android デバイスにおけるログファイルからの情報漏えいに関する脆弱性

Title	Vivo V7 Android デバイスにおけるログファイルからの情報漏えいに関する脆弱性
Summary	Vivo V7 Android デバイスには、ログファイルからの情報漏えいに関する脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Dec. 28, 2018, midnight
Registration Date	March 19, 2019, 5:41 p.m.
Last Update	March 19, 2019, 5:41 p.m.

Affected System

Vivo

Vivo V7 ファームウェア 1.0

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-15001	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15001
2	CVE-2018-15001	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15001
National Vulnerability Database (NVD)
3	CVE-2018-15001	https://nvd.nist.gov/vuln/detail/CVE-2018-15001
4	CVE-2018-15001	https://nvd.nist.gov/vuln/detail/CVE-2018-15001

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-532	https://cwe.mitre.org/data/definitions/532.html
2	CWE-532	https://cwe.mitre.org/data/definitions/532.html

ベンダー情報

No	Name	URL
Vivo
1	V7	https://www.vivo.com/in/products/v7
2	V7	https://www.vivo.com/in/products/v7

その他

No	Name	URL
関連文書
1	DEFCON 2018: Vulnerable Out of the Box - An Evaluation of Android Carrier Devices	https://www.kryptowire.com/portal/android-firmware-defcon-2018/
2	DEFCON 2018: Vulnerable Out of the Box - An Evaluation of Android Carrier Devices	https://www.kryptowire.com/portal/android-firmware-defcon-2018/
3	Vulnerable Out of the Box:An Evaluation of Android Carrier Devices	https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf
4	Vulnerable Out of the Box:An Evaluation of Android Carrier Devices	https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf

Change Log

No	Changed Details	Date of change
1	[2019年03月19日] 掲載	March 19, 2019, 5:41 p.m.
1	[2019年03月19日] 掲載	March 19, 2019, 5:41 p.m.