CVE-2012-2217 The HTC IQRD service for Android on the HTC EVO 4G before 4.67.651.3, EVO Design 4G before 2.12.651.5, Shift 4G before 2.77.651.3, EVO 3D before 2.17.651.5, EVO View 4G before 2.23.651.1, Vivid before...
MediumCVSS 6.4
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The HTC IQRD service for Android on the HTC EVO 4G before 4.67.651.3, EVO Design 4G before 2.12.651.5, Shift 4G before 2.77.651.3, EVO 3D before 2.17.651.5, EVO View 4G before 2.23.651.1, Vivid before 3.26.502.56, and Hero does not restrict localhost access to TCP port 2479, which allows remote attackers to (1) send SMS messages, (2) obtain the Network Access Identifier (NAI) and its password, or trigger (3) popup messages or (4) tones via a crafted application that leverages the android.permission.INTERNET permission.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| htc evo 4g software | <= 4.54.651.1 | No fix listed |
| htc evo 4g software | = 1.32.651.1 | No fix listed |
| htc evo 4g software | = 1.47.651.1 | No fix listed |
| htc evo 4g software | = 3.26.651.6 | No fix listed |
| htc evo 4g software | = 3.29.651.5 | No fix listed |
| htc evo 4g software | = 3.30.651.2 | No fix listed |
| htc evo 4g software | = 3.30.651.3 | No fix listed |
| htc evo 4g software | = 3.70.651.1 | No fix listed |
| htc evo 4g software | = 4.22.651.2 | No fix listed |
| htc evo 4g software | = 4.24.651.1 | No fix listed |
| htc evo 4g software | = 4.53.651.1 | No fix listed |
| htc evo 4g | All versions | No fix listed |
| htc evo 4g | = gri40 | No fix listed |
| htc evo design 4g software | <= 1.19.651.1 | No fix listed |
| htc evo design 4g software | = 1.19.651.0 | No fix listed |
| htc evo design 4g | All versions | No fix listed |
| htc shift 4g software | <= 2.76.651.6 | No fix listed |
| htc shift 4g software | = 1.17.651.1 | No fix listed |
| htc shift 4g software | = 2.75.651.4 | No fix listed |
| htc shift 4g software | = 2.75.651.5 | No fix listed |
| htc shift 4g | All versions | No fix listed |
| htc evo 3d software | <= 2.08.651.3 | No fix listed |
| htc evo 3d software | = 1.11.651.3 | No fix listed |
| htc evo 3d software | = 1.13.651.7 | No fix listed |
| htc evo 3d software | = 2.08.651.2 | No fix listed |
Show 14 more
| Product | Affected versions | Fixed in |
|---|---|---|
| htc evo 3d | All versions | No fix listed |
| htc evo 3d | = gri40 | No fix listed |
| htc evo view 4g software | <= 1.22.651.2 | No fix listed |
| htc evo view 4g software | = 1.22.651.1 | No fix listed |
| htc evo view 4g | All versions | No fix listed |
| htc vivid software | <= 3.26.502 | No fix listed |
| htc vivid | All versions | No fix listed |
| htc hero software | = 1.29.651.1 | No fix listed |
| htc hero software | = 1.56.651.2 | No fix listed |
| htc hero software | = 2.27.651.5 | No fix listed |
| htc hero software | = 2.27.651.6 | No fix listed |
| htc hero software | = 2.31.651.7 | No fix listed |
| htc hero software | = 2.32.651.2 | No fix listed |
| htc hero | All versions | No fix listed |
References
- 20120421 HTC IQRD Android Permission Leakage (CVE-2012-2217) mailing-list
- 53187 vdb-entry
- www.vsecurity.com
- htc-iqrd-sec-bypass(75080) vdb-entry