JVN#63428218: Cybozu Live for Android vulnerable to arbitrary Java method execution

Cybozu Live for Android is a client software for Cybozu Live. Cybozu Live for Android contains an arbitrary Java method execution vulnerability.

Note that this vulnerability is a regression in version 2.0.0 of the issue in JVN#23009798.

Impact

When opening a specially crafted website, an attacker may be able to execute an arbitrary Java method. As a result, information stored in Android devices may be obtained or arbitrary OS commands may be executed.

Solution

Update the software
Update to the latest version according to the information provided by the developer.

Products Affected

• Cybozu Live for Android version 2.0.0