{"id": "CVE-2016-6564", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2018-07-13T20:29:01.050", "references": [{"url": "https://www.bitsighttech.com/blog/ragentek-android-ota-update-mechanism-vulnerable-to-mitm-attack", "tags": ["Exploit", "Third Party Advisory"], "source": "cret@cert.org"}, {"url": "https://www.kb.cert.org/vuls/id/624539", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cret@cert.org"}, {"url": "https://www.securityfocus.com/bid/94393/", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cret@cert.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}, {"type": "Secondary", "source": "cret@cert.org", "description": [{"lang": "en", "value": "CWE-494"}]}], "descriptions": [{"lang": "en", "value": "Android devices with code from Ragentek contain a privileged binary that performs over-the-air (OTA) update checks. Additionally, there are multiple techniques used to hide the execution of this binary. This behavior could be described as a rootkit. This binary, which resides as /system/bin/debugs, runs with root privileges and does not communicate over an encrypted channel. The binary has been shown to communicate with three hosts via HTTP: oyag[.]lhzbdvm[.]com oyag[.]prugskh[.]net oyag[.]prugskh[.]com Server responses to requests sent by the debugs binary include functionalities to execute arbitrary commands as root, install applications, or update configurations. Examples of a request sent by the client binary: POST /pagt/agent?data={\"name\":\"c_regist\",\"details\":{...}} HTTP/1. 1 Host: 114.80.68.223 Connection: Close An example response from the server could be: HTTP/1.1 200 OK {\"code\": \"01\", \"name\": \"push_commands\", \"details\": {\"server_id\": \"1\" , \"title\": \"Test Command\", \"comments\": \"Test\", \"commands\": \"touch /tmp/test\"}} This binary is reported to be present in the following devices: BLU Studio G BLU Studio G Plus BLU Studio 6.0 HD BLU Studio X BLU Studio X Plus BLU Studio C HD Infinix Hot X507 Infinix Hot 2 X510 Infinix Zero X506 Infinix Zero 2 X509 DOOGEE Voyager 2 DG310 LEAGOO Lead 5 LEAGOO Lead 6 LEAGOO Lead 3i LEAGOO Lead 2S LEAGOO Alfa 6 IKU Colorful K45i Beeline Pro 2 XOLO Cube 5.0"}, {"lang": "es", "value": "Los dispositivos Android con c\u00f3digo de Ragentek contienen un binario privilegiado que realiza comprobaciones de actualizaciones OTA (over-the-air). Adem\u00e1s, hay m\u00faltiples t\u00e9cnicas en uso para ocultar la ejecuci\u00f3n de este binario. El comportamiento podr\u00eda describirse como rootkit. Este binario, que reside como /system/bin/debugs, se ejecuta con privilegios root y no se comunica mediante un canal cifrado. Se ha mostrado que el binario se comunica con tres hosts mediante HTTP: oyag[.]lhzbdvm[.]com, oyag[.]prugskh[.]net y oyag[.]prugskh[.]com. Las respuestas del servidor a las peticiones enviadas por el binario debugs incluyen funcionalidades para ejecutar comandos arbitrarios como root, instalar aplicaciones o actualizar configuraciones. Ejemplos de una petici\u00f3n enviada por el binario del cliente: POST /pagt/agent?data={\"name\":\"c_regist\",\"details\":{...}} HTTP/1. 1 Host: 114.80.68.223 Connection: Close Un ejemplo de respuesta del servidor podr\u00eda ser: HTTP/1.1 200 OK {\"code\": \"01\", \"name\": \"push_commands\", \"details\": {\"server_id\": \"1\" , \"title\": \"Test Command\", \"comments\": \"Test\", \"commands\": \"touch /tmp/test\"}} Se ha informado que este binario est\u00e1 presente en los siguientes dispositivos: BLU Studio G, BLU Studio G Plus, BLU Studio 6.0 HD, BLU Studio X, BLU Studio X Plus, BLU Studio C HD, Infinix Hot X507, Infinix Hot 2 X510, Infinix Zero X506, Infinix Zero 2 X509, DOOGEE Voyager 2 DG310, LEAGOO Lead 5, LEAGOO Lead 6, LEAGOO Lead 3i, LEAGOO Lead 2S, LEAGOO Alfa 6, IKU Colorful K45i, Beeline Pro 2 y XOLO Cube 5.0."}], "lastModified": "2019-10-09T23:19:16.487", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:infinixauthority:hot_x507_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E1F7E6D-36C1-43C1-A082-012A2B076083"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:infinixauthority:hot_x507:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DF0E9213-E92E-437F-B818-CAC49714359B"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:infinixauthority:hot_2_x510_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16C972BB-1621-484F-B760-66F14606F22D"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:infinixauthority:hot_2_x510:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8848D000-4085-431F-B459-846B61F1F519"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:infinixauthority:zero_x506_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CCAEC49E-64D7-48E2-A20E-843A152C3342"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:infinixauthority:zero_x506:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "21EB5937-CD55-4E7D-9DCC-B5A9DC35C092"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:infinixauthority:zero_2_x509_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D72E356A-3776-437F-A01B-782686978296"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:infinixauthority:zero_2_x509:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "838DC11A-5928-4CE1-8C47-6DB304CB774F"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:bluproducts:studio_g_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "250622C8-483C-4E50-B299-14E0B4AF9596"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:bluproducts:studio_g:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1405ED4B-8F63-4C11-A4D8-BE65DE153D0F"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:bluproducts:studio_g_plus_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75A2B779-523A-4541-A2F5-D6084F18A82A"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:bluproducts:studio_g_plus:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "872770AE-33BB-45A0-8FF4-48B981FC3F1E"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:bluproducts:studio_6.0_hd_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "586F417B-2560-4E1E-8D42-8A04E9293BAD"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:bluproducts:studio_6.0_hd:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "04767248-D023-4BE8-8243-51F94864D1D1"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:bluproducts:studio_x_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D958325-08EF-49EC-913F-CC35DF9FA1A2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:bluproducts:studio_x:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "019D185F-6C7D-4D81-997B-59C6659CA5AF"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:bluproducts:studio_x_plus_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "966C5CA1-AE21-4AFC-8ACF-890C216290A0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:bluproducts:studio_x_plus:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "743EB295-520E-4F12-B395-52BC7BA8E4D5"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:bluproducts:studio_c_hd_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9DB6E094-0FFF-4992-997F-C2221F65E922"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:bluproducts:studio_c_hd:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4F09A667-7100-40F7-B03F-3D1F9E0728C8"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:xolo:cube_5.0_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F23993D-E0F9-4CE9-8EF8-5AF8C3F9DD11"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:xolo:cube_5.0:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A20F8D62-AADC-4FE8-B586-F2135102E87A"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:beeline:pro_2_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1229649-DC71-47A0-BD74-A78E294DFDFB"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:beeline:pro_2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A9A04BB6-DC55-4693-A451-D62E0022F34E"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:iku-mobile:colorful_k45i_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "173B7772-7FF4-434D-BB2C-6E80127554DB"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:iku-mobile:colorful_k45i:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1BBC0D73-2936-43C6-9541-29191208B86D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:leagoo:lead_5_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D53592AF-6A78-4294-B792-A49C391DC341"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:leagoo:lead_5:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BC2DE373-9BD3-4BBF-837F-73ECE7700448"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:leagoo:lead_6_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6144A49D-7D85-419B-B3F1-18A943245738"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:leagoo:lead_6:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F5A0FDDC-DC1F-4D83-9273-2872769EB9F5"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:leagoo:lead_3i_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDF0B78D-43F2-4FF2-8430-04838F943196"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:leagoo:lead_3i:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0A2B0180-99DD-4E49-89A8-7037C80C6F0D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:leagoo:lead_2s_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B12B475-7A3A-436C-BCFA-7DF212276B5C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:leagoo:lead_2s:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3AF3DE21-DD1C-4897-9B91-7261601C8A38"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:leagoo:alfa_6_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF32D104-7EF5-47A0-B500-EF01913C35AC"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:leagoo:alfa_6:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FB27875D-2936-4540-812B-F958D19E5DEE"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:doogee:voyager_2_dg310i_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "837AA3EA-0EB5-4D77-A6CB-B981B2BAEE93"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:doogee:voyager_2_dg310i:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "75EC02F5-835F-4752-87FE-009DEB2153F6"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cret@cert.org"}
