First published: Fri Dec 28 2018(Updated: )
The Coolpad Canvas device with a build fingerprint of Coolpad/cp3636a/cp3636a:7.0/NRD90M/093031423:user/release-keys contains a platform app with a package name of com.qualcomm.qti.modemtestmode (versionCode=24, versionName=7.0) that contains an exported service app component named com.qualcomm.qti.modemtestmode.MbnTestService that allows any app on the device to set certain system properties as the com.android.phone user. When an app sets the persist.service.logr.enable system property to a value of 1, an app with a package name of com.yulong.logredirect (versionCode=20160622, versionName=5.25_20160622_01) will start writing the system-wide logcat log, kernel log, and a tcpdump network traffic capture to external storage. Furthermore, on the Coolpad Canvas device, the com.android.phone app writes the destination phone number and body of the text message for outgoing text messages. A notification when logging can be avoided if the log is enabled after device startup and disabled prior to device shutdown by setting the system properties using the exported interface of the com.qualcomm.qti.modemtestmode app. Any app with the READ_EXTERNAL_STORAGE permission can access the log files.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Coolpad Canvas Firmware | =7.0 | |
Coolpad Canvas |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2018-15004 is classified as a high severity vulnerability due to the presence of an exported service component that could be exploited by attackers.
To mitigate CVE-2018-15004, it's recommended to update the Coolpad Canvas device firmware to a version that addresses this vulnerability.
CVE-2018-15004 specifically affects the Coolpad Canvas device running firmware version 7.0.
Exploiting CVE-2018-15004 could allow unauthorized access to sensitive data or functionalities through the vulnerable exported service.
Currently, the best workaround for CVE-2018-15004 is to ensure that the device is not exposed to untrusted applications until a firmware update is available.