CVE-2014-0806 - Infoleak

Q: Who is exposed to this issue?

Users of Sleipnir Mobile and Sleipnir Mobile Black Edition for Android version 2.12.1 or earlier are exposed when they visit a website that invokes the Geolocation API.

Q: What does an attacker need to exploit it?

An attacker needs to operate or induce a user to visit a website that makes Geolocation API calls. No authentication is required according to the reported vector.

Q: Is user approval required before location data can be obtained?

No. The affected applications provide Geolocation API data without verifying user consent, allowing a remote website to obtain sensitive location information.

Affected Software

73 affected components

Fenrir-inc Sleipnir Mobile<=2.12.1

Fenrir-inc Sleipnir Mobile=1.0.0-alpha

Fenrir-inc Sleipnir Mobile=1.0.0-beta_update1

Fenrir-inc Sleipnir Mobile=1.0.0-rc

Fenrir-inc Sleipnir Mobile=1.1.0

Fenrir-inc Sleipnir Mobile=1.2.0

Fenrir-inc Sleipnir Mobile=1.3.0

Fenrir-inc Sleipnir Mobile=1.4.0

Fenrir-inc Sleipnir Mobile=1.5.0

Fenrir-inc Sleipnir Mobile=1.5.1

Fenrir-inc Sleipnir Mobile=1.6.0

Fenrir-inc Sleipnir Mobile=1.7.0

Fenrir-inc Sleipnir Mobile=1.7.1

Fenrir-inc Sleipnir Mobile=2.0.0

Fenrir-inc Sleipnir Mobile=2.0.1

Fenrir-inc Sleipnir Mobile=2.0.2

Fenrir-inc Sleipnir Mobile=2.0.3

Fenrir-inc Sleipnir Mobile=2.0.4

Fenrir-inc Sleipnir Mobile=2.1.0

Fenrir-inc Sleipnir Mobile=2.2.0

Fenrir-inc Sleipnir Mobile=2.2.1

Fenrir-inc Sleipnir Mobile=2.2.2

Fenrir-inc Sleipnir Mobile=2.2.3

Fenrir-inc Sleipnir Mobile=2.3.0

Fenrir-inc Sleipnir Mobile=2.4.0

Fenrir-inc Sleipnir Mobile=2.4.1

Fenrir-inc Sleipnir Mobile=2.5.0

Fenrir-inc Sleipnir Mobile=2.5.1

Fenrir-inc Sleipnir Mobile=2.6.0

Fenrir-inc Sleipnir Mobile=2.7.0

Fenrir-inc Sleipnir Mobile=2.8.0

Fenrir-inc Sleipnir Mobile=2.9.0

Fenrir-inc Sleipnir Mobile=2.9.1

Fenrir-inc Sleipnir Mobile Android=2.10

Fenrir-inc Sleipnir Mobile=2.10.0

Fenrir-inc Sleipnir Mobile=2.11

Fenrir-inc Sleipnir Mobile=2.12

Fenrir-inc Sleipnir Mobile=2.12.1

Event History

Jan 22, 2014

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Data Sourced

via NVD·09:55 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

Who is exposed to this issue?

Users of Sleipnir Mobile and Sleipnir Mobile Black Edition for Android version 2.12.1 or earlier are exposed when they visit a website that invokes the Geolocation API.

2

What does an attacker need to exploit it?

An attacker needs to operate or induce a user to visit a website that makes Geolocation API calls. No authentication is required according to the reported vector.

3

Is user approval required before location data can be obtained?

No. The affected applications provide Geolocation API data without verifying user consent, allowing a remote website to obtain sensitive location information.

CVE-2014-0806: Infoleak

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Is user approval required before location data can be obtained?

Company

Resources

Contact