Lucene search

[email protected]CVE-2013-4787

HistoryOct 03, 2022 - 4:14 p.m.

CVE-2013-4787

2022-10-0316:14:59

CWE-310

[email protected]

web.nvd.nist.gov

android security

master key vulnerability

apk

code execution

cryptographic signatures

zip file

nvd

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.5%

JSON

Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file (APK) that is modified in a way that does not violate the cryptographic signature, probably involving multiple entries in a Zip file with the same name in which one entry is validated but the other entry is installed, aka Android security bug 8219321 and the “Master Key” vulnerability.

Affected configurations

NVD

Node

googleandroidMatch1.6

googleandroidMatch2.0

googleandroidMatch2.0.1

googleandroidMatch2.1

googleandroidMatch2.2

googleandroidMatch2.2rev1

googleandroidMatch2.2.1

googleandroidMatch2.2.2

googleandroidMatch2.2.3

googleandroidMatch2.3

googleandroidMatch2.3rev1

googleandroidMatch2.3.1

googleandroidMatch2.3.2

googleandroidMatch2.3.3

googleandroidMatch2.3.4

googleandroidMatch2.3.5

googleandroidMatch2.3.6

googleandroidMatch2.3.7

googleandroidMatch3.0

googleandroidMatch3.1

googleandroidMatch3.2

googleandroidMatch3.2.1

googleandroidMatch3.2.2

googleandroidMatch3.2.4

googleandroidMatch3.2.6

googleandroidMatch4.0

googleandroidMatch4.0.1

googleandroidMatch4.0.2

googleandroidMatch4.0.3

googleandroidMatch4.0.4

googleandroidMatch4.1

googleandroidMatch4.1.2

googleandroidMatch4.2

CPENameOperatorVersion
google:androidgoogle androideq1.6
google:androidgoogle androideq2.0
google:androidgoogle androideq2.0.1
google:androidgoogle androideq2.1
google:androidgoogle androideq2.2
google:androidgoogle androideq2.2.1
google:androidgoogle androideq2.2.2
google:androidgoogle androideq2.2.3
google:androidgoogle androideq2.3
google:androidgoogle androideq2.3.1

CPE	Name	Operator	Version
google:android	google android	eq	1.6
google:android	google android	eq	2.0
google:android	google android	eq	2.0.1
google:android	google android	eq	2.1
google:android	google android	eq	2.2
google:android	google android	eq	2.2.1
google:android	google android	eq	2.2.2
google:android	google android	eq	2.2.3
google:android	google android	eq	2.3
google:android	google android	eq	2.3.1

Rows per page:

1-10 of 311

References

bluebox.com/corporate-blog/bluebox-uncovers-android-master-key/

review.cyanogenmod.org/#/c/45251/

www.osvdb.org/94773

www.securityfocus.com/bid/60952

www.zdnet.com/google-releases-fix-to-oems-for-blue-security-android-security-hole-7000017782/

jira.cyanogenmod.org/browse/CYAN-1602

plus.google.com/113331808607528811927/posts/GxDA6111vYy

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.5%

JSON

Related for CVE-2013-4787

prion1 android1 nvd1 cvelist1