CVE-2014-1423 Online Accounts Signon daemon gives out all oauth tokens to any app
MediumCVSS 5.5
EPSS 0.84%
- Published
- Updated
- Exploit status
- No public exploit known
Description
signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due to incorrect checks and the missing installation of the signon-apparmor-extension. An attacker could use this create a malicious click app that collects oauth tokens for other applications, exposing sensitive information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| signond project signond | < 8.57\+15.04.20141127.1-0ubuntu1 | 8.57\+15.04.20141127.1-0ubuntu1 |
| UBports ubuntu touch | All versions | No fix listed |
| ubuntu signon | >= Ubuntu 15.04 signon, < 8.57+15.04.20141127.1-0ubuntu1 | 8.57+15.04.20141127.1-0ubuntu1 |
References
- bazaar.launchpad.net third-party-advisory
- bazaar.launchpad.net third-party-advisory
- bugs.launchpad.net third-party-advisory