CVE-2015-7888

Related Files

Samsung WifiHs20UtilityService Path Traversal

Posted Oct 27, 2015

Authored by Google Security Research, markbrand

A path traversal vulnerability was found in the WifiHs20UtilityService. This service is running on a Samsung S6 Edge device, and may be present on other Samsung device models. WifiHs20UtilityService reads any files placed in /sdcard/Download/cred.zip, and unzips this file into /data/bundle. Directory traversal in the path of the zipped contents allows an attacker to write a controlled file to an arbitrary path as the system user.

tags | exploit, arbitrary

systems | linux

advisories | CVE-2015-7888

SHA-256 | 518c9bcbcc800ca3f2eabf30aca38ce8d0b16a83ab93ae8b359b37e023aa64a9

Download | Favorite | View