CVE-2013-6770: High severity Koushik Dutta Superuser vulnerability

Published Mar 30, 2014

Updated

The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.3 and 4.4 does not properly restrict the set of users who can execute /system/xbin/su with the --daemon option, which allows attackers to gain privileges by leveraging ADB shell access and a certain Linux UID, and then creating a Trojan horse script.

Affected Software

6 affected components

Koushik Dutta Superuser=1.0.2.1

Google Android=4.3

Google Android=4.4

All of the following

Koushik Dutta Superuser=1.0.2.1

Any of the following

Google Android=4.3

Google Android=4.4

Event History

Mar 30, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Mar 31, 2014

Data Sourced

via NVD·02:58 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2013-6770?

The severity of CVE-2013-6770 is classified as high due to the potential for privilege escalation.

How do I fix CVE-2013-6770?

To fix CVE-2013-6770, it is recommended to update the Superuser package to a version that addresses this vulnerability.

What versions are affected by CVE-2013-6770?

CVE-2013-6770 affects the Koushik Dutta Superuser package version 1.0.2.1 on Android 4.3 and 4.4.

What types of attacks can exploit CVE-2013-6770?

CVE-2013-6770 can be exploited through ADB shell access allowing attackers to gain elevated privileges.

Is CVE-2013-6770 a remote or local exploit?

CVE-2013-6770 is a local exploit, requiring access to the device via ADB for successful execution.