National Cyber Awareness System

Vulnerability Summary for CVE-2011-4872

Overview

Multiple HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40, and EVO 4G GRI40 allow remote attackers to obtain 802.1X Wi-Fi credentials and SSID via a crafted application that uses the android.permission.ACCESS_WIFI_STATE permission to call the toString method on the WifiConfiguration class.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#763355

Name: VU#763355

Hyperlink:http://www.kb.cert.org/vuls/id/763355

External Source: BID

Name: 51790

Hyperlink:http://www.securityfocus.com/bid/51790

External Source: SECUNIA

Name: 47837

Type: Advisory

Hyperlink:http://secunia.com/advisories/47837

External Source: MISC

Name: http://blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html

Hyperlink:http://blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html

External Source: BUGTRAQ

Name: 20120201 802.1X password exploit on many HTC Android devices

Hyperlink:http://archives.neohapsis.com/archives/bugtraq/2012-02/0002.html