CVE-2013-6775: Critical severity Chainfire Supersu Android vulnerability
Published Mar 30, 2014
·Updated
The Chainfire SuperSU package before 1.69 for Android allows attackers to gain privileges via the (1) backtick or (2) $() type of shell metacharacters in the -c option to /system/xbin/su.
Affected Software
78 affected components
Chainfire Supersu Android=1.69
Google Android=1.0
Google Android=1.1
Google Android=1.5
Google Android=1.6
Google Android=2.0
Google Android=2.0.1
Google Android=2.1
Google Android=2.2
Google Android=2.2-rev1
Google Android=2.2.1
Google Android=2.2.2
Google Android=2.2.3
Google Android=2.3
Google Android=2.3-rev1
Google Android=2.3.1
Google Android=2.3.2
Google Android=2.3.3
Google Android=2.3.4
Google Android=2.3.5
Google Android=2.3.6
Google Android=2.3.7
Google Android=3.0
Google Android=3.1
Google Android=3.2
Google Android=3.2.1
Google Android=3.2.2
Google Android=3.2.4
Google Android=3.2.6
Google Android=4.0
Google Android=4.0.1
Google Android=4.0.2
Google Android=4.0.3
Google Android=4.0.4
Google Android=4.1
Google Android=4.1.2
Google Android=4.2
Google Android=4.2.1
Google Android=4.2.2
All of the following
Chainfire Supersu Android=1.69
Any of the following
Google Android=1.0
Google Android=1.1
Google Android=1.5
Google Android=1.6
Google Android=2.0
Google Android=2.0.1
Google Android=2.1
Google Android=2.2
Google Android=2.2-rev1
Google Android=2.2.1
Google Android=2.2.2
Google Android=2.2.3
Google Android=2.3
Google Android=2.3-rev1
Google Android=2.3.1
Google Android=2.3.2
Google Android=2.3.3
Google Android=2.3.4
Google Android=2.3.5
Google Android=2.3.6
Google Android=2.3.7
Google Android=3.0
Google Android=3.1
Google Android=3.2
Google Android=3.2.1
Google Android=3.2.2
Google Android=3.2.4
Google Android=3.2.6
Google Android=4.0
Google Android=4.0.1
Google Android=4.0.2
Google Android=4.0.3
Google Android=4.0.4
Google Android=4.1
Google Android=4.1.2
Google Android=4.2
Google Android=4.2.1
Google Android=4.2.2
Event History
Mar 30, 2014
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Mar 31, 2014
Data Sourced
via NVD·02:58 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2013-6775?
CVE-2013-6775 is classified as a medium severity vulnerability.
2
How do I fix CVE-2013-6775?
To fix CVE-2013-6775, update the Chainfire SuperSU package to version 1.69 or later.
3
What systems are affected by CVE-2013-6775?
CVE-2013-6775 affects versions of the Chainfire SuperSU package prior to 1.69 on Android devices.
4
What type of vulnerability is CVE-2013-6775?
CVE-2013-6775 is a privilege escalation vulnerability due to improper handling of shell metacharacters.
5
Can CVE-2013-6775 be exploited remotely?
CVE-2013-6775 requires local access to the device, making remote exploitation unlikely.