CVE-2014-8610
AndroidManifest.xml in Android before 5.0.0 does not require the SEND_SMS permission for the SmsReceiver receiver, which allows attackers to send stored SMS messages, and consequently transmit arbitrary new draft SMS messages or trigger additional…
Does this matter?
Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.
Description
AndroidManifest.xml in Android before 5.0.0 does not require the SEND_SMS permission for the SmsReceiver receiver, which allows attackers to send stored SMS messages, and consequently transmit arbitrary new draft SMS messages or trigger additional per-message charges from a network operator for old messages, via a crafted application that broadcasts an intent with the com.android.mms.transaction.MESSAGE_SENT action, aka Bug 17671795.
- CVSS 2.0
- 3.3 LOWAV:L/AC:M/Au:N/C:P/I:P/A:N
- EPSS
- 0.34% probability · 27th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- google/android
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/129282/Android-SMS-Resend.htmlExploit
- http://seclists.org/fulldisclosure/2014/Dec/8Exploit
- http://seclists.org/fulldisclosure/2014/Nov/85
- http://xteam.baidu.com/?p=164Exploit
- https://android.googlesource.com/platform/packages/apps/Mms/+/008d6202fca4002a7dfe333f22377faa73585c67Vendor Advisory
- https://github.com/joswr1ght/drozer-modules/blob/master/whfs/smsdraftsend.pyExploit
- http://packetstormsecurity.com/files/129282/Android-SMS-Resend.htmlExploit
- http://seclists.org/fulldisclosure/2014/Dec/8Exploit
- http://seclists.org/fulldisclosure/2014/Nov/85
- http://xteam.baidu.com/?p=164Exploit
- https://android.googlesource.com/platform/packages/apps/Mms/+/008d6202fca4002a7dfe333f22377faa73585c67Vendor Advisory
- https://github.com/joswr1ght/drozer-modules/blob/master/whfs/smsdraftsend.pyExploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.