First published: Sat Dec 14 2013(Updated: )
Android 4.0 through 4.3 allows attackers to bypass intended access restrictions and remove device locks via a crafted application that invokes the updateUnlockMethodAndFinish method in the com.android.settings.ChooseLockGeneric class with the PASSWORD_QUALITY_UNSPECIFIED option.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Android | =4.0 | |
Android | =4.0.1 | |
Android | =4.0.2 | |
Android | =4.0.3 | |
Android | =4.0.4 | |
Android | =4.1 | |
Android | =4.1.2 | |
Android | =4.2 | |
Android | =4.2.1 | |
Android | =4.2.2 | |
Android | =4.3 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2013-6271 is considered a high-severity vulnerability due to its ability to allow attackers to bypass device lock security features.
To mitigate CVE-2013-6271, users should update their Android devices to versions later than 4.3 that include patches for this vulnerability.
CVE-2013-6271 affects Android versions 4.0 through 4.3.
The impact of CVE-2013-6271 includes unauthorized access to device data by bypassing the lock screen.
It is not safe to use Android versions affected by CVE-2013-6271, and it is strongly recommended to upgrade to a patched version.