Is CVE-2016-10136 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-10136 being exploited in the wild.

How severe is CVE-2016-10136?

High severity, with a CVSS score of 7.8, published 13 January 2017.

Which products and versions are affected?

BLU R1 HD Shanghai Adups software.

Is there a fix for CVE-2016-10136?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2016-10136 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2016-10136?

Check whether you run Adups Fota. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-10136: BLU R1 HD privilege escalation in Adups FOTA software

CVE-2016-10136 · Severity: high · CVSS 7.8 · Published 2017-01-13

A security flaw in the Adups software pre-installed on BLU R1 HD mobile devices allows malicious apps to gain full control over the phone's system. An attacker could use this to read private text messages, steal account login tokens, and delete critical system files. This compromise could lead to total loss of privacy and device functionality for the user.

Technologies: Adups Fota. Vendors: Adups.

Quick answers

Is CVE-2016-10136 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-10136 being exploited in the wild.
How severe is CVE-2016-10136?: High severity, with a CVSS score of 7.8, published 13 January 2017.
Which products and versions are affected?: BLU R1 HD Shanghai Adups software.
Is there a fix for CVE-2016-10136?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-10136 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2016-10136?: Check whether you run Adups Fota. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Adups FOTA application (com.adups.fota.sysoper) on BLU R1 HD devices contains an insecurely configured Content Provider named com.adups.fota.sysoper.provider.InfoProvider. Because the application is configured with the 'android.uid.system' shared user ID, it executes with elevated system privileges. Any third-party application installed on the device can interact with this provider to perform file operations (read/write/delete) as the system user. This allows attackers to modify secure settings to intercept notifications or access the accounts database to steal authentication tokens.

Affected products

BLU R1 HD Shanghai Adups software

Timeline

2016-11-16: disclosed: Public reporting on Adups software security issues
2017-01-13: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.