exploit the possibilities

Samsung Display Solutions Application For Android Content Injection

Samsung Display Solutions Application For Android Content Injection
Posted Mar 2, 2018
Authored by Yakov Shafranovich | Site wwws.nightwatchcybersecurity.com

Samsung Display Solutions Application for Android did not use encryption (SSL) for information transmission, thus allowing a man-in-the-middle attacker to inject their own content into the application. The vendor fixed this issue and users should install the latest version (3.02 or above).

tags | advisory
advisories | CVE-2018-6019
MD5 | 5083d1933d4bb7a84cbb98b80fd89f21

Samsung Display Solutions Application For Android Content Injection

Change Mirror Download
[Original post here:
https://wwws.nightwatchcybersecurity.com/2018/03/01/content-injection-in-samsung-display-solutions-application-for-android-cve-2018-6019/]

TITLE

Content Injection in Samsung Display Solutions Application for Android
[CVE-2018-6019]

SUMMARY

Samsung Display Solutions App for Android did not use encryption (SSL)
for information transmission, thus allowing an MITM attacker to inject
their own content into the app. The vendor fixed this issue and users
should install the latest version (3.02 or above). MITRE has assigned
CVE-2018-6019 to track this issue.

DETAILS

Samsung makes an Android application that allows users to browse B2B
content related to Samsungas display products. While performing
network level testing, we discovered that the content shown in the app
was loaded via server calls made by the application without any kind
of encryption (SSL). This allowed an MITM attacker to inject their own
content into the app.

To observe the issue on v3.01:
1. Install the application on the device.
2. Setup an MITM proxy but do not install the SSL certificate on the
device (we used PacketCapture).
3. Start the proxy. At this point all network traffic will be going
through the proxy with the SSL traffic being encrypted by a
self-signed certificate which is not trusted by the device.
4. Open the app.
5. Go back to the proxy and observe captured traffic.

All testing was done on Android 7 and application version 3.01.
Network captures were performed using an on-device proxy
(PacketCapture) without a trusted SSL certificate.

VENDOR RESPONSE

The vendor fixed this issue and users should install the latest
version (3.02 or above).

REFERENCES

CVE ID: CVE-2018-6019
Google Play Link:
https://play.google.com/store/apps/details?id=com.sds.samsung.global

BOUNTY INFORMATION

This issue was originally reported to the Samsung Mobile Security
Bounty Program but was deemed to be out of scope. However, after being
transferred to the Display Solutions team, this issue qualified for
the Samsung TV Bounty Program.

CREDITS

Advisory written by Yakov Shafranovich.

TIMELINE

2017-09-09: Reported to Samsung Mobile Security bounty program
2017-09-09: Automated response from the vendor received
2017-10-18: Engineer assigned to the issue
2017-11-19: Deemed out of scope; reply sent
2017-11-25: Vendor requests additional information; reply sent
2017-11-27: Issue rejected, public disclosure requested
2017-12-06: Reply from vendor received, additional information
requested; reply sent
2017-12-07: Additional information requested by the vendor
2017-12-09: Reply sent with screenshots
2018-01-08: Vendor accepts the issue as in scope, and plans remediation
2018-01-11: Issue transferred to the Samsung TV bounty program
2018-01-14: Fixed version released
2018-01-22: CVE requested and received from MITRE
2018-02-14: Vendor requests confirmation of the fix, fix confirmed and
reply sent
2018-03-25: Draft advisory sent to vendor for review; bounty payment received
2018-03-01: Public disclosure


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

May 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    16 Files
  • 2
    May 2nd
    8 Files
  • 3
    May 3rd
    8 Files
  • 4
    May 4th
    2 Files
  • 5
    May 5th
    1 Files
  • 6
    May 6th
    15 Files
  • 7
    May 7th
    22 Files
  • 8
    May 8th
    16 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    16 Files
  • 11
    May 11th
    3 Files
  • 12
    May 12th
    4 Files
  • 13
    May 13th
    25 Files
  • 14
    May 14th
    24 Files
  • 15
    May 15th
    78 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    16 Files
  • 18
    May 18th
    2 Files
  • 19
    May 19th
    1 Files
  • 20
    May 20th
    11 Files
  • 21
    May 21st
    21 Files
  • 22
    May 22nd
    20 Files
  • 23
    May 23rd
    36 Files
  • 24
    May 24th
    2 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close