Is CVE-2016-10137 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-10137 being exploited in the wild.

How severe is CVE-2016-10137?

High severity, with a CVSS score of 7.8, published 13 January 2017.

Which products and versions are affected?

BLU R1 HD Shanghai Adups software.

Is there a fix for CVE-2016-10137?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2016-10137 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2016-10137?

Check whether you run Adups Fota or BLU R1 HD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-10137: BLU R1 HD privilege escalation in Adups FOTA InfoProvider

CVE-2016-10137 · Severity: high · CVSS 7.8 · Published 2017-01-13

A security vulnerability was identified in BLU R1 HD mobile devices running Shanghai Adups software. A pre-installed system application allows other apps on the phone to bypass standard security protections to read, write, or delete sensitive user data. This could allow a malicious app to steal private information such as text messages, call logs, and other personally identifiable information without the user's knowledge.

Technologies: Adups Fota, BLU R1 HD. Vendors: Adups, BLU.

Quick answers

Is CVE-2016-10137 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-10137 being exploited in the wild.
How severe is CVE-2016-10137?: High severity, with a CVSS score of 7.8, published 13 January 2017.
Which products and versions are affected?: BLU R1 HD Shanghai Adups software.
Is there a fix for CVE-2016-10137?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-10137 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2016-10137?: Check whether you run Adups Fota or BLU R1 HD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the com.adups.fota.sysoper.provider.InfoProvider content provider within the com.adups.fota.sysoper package. The application is configured with the android:sharedUserId attribute set to 'android.uid.system', causing it to execute with elevated system privileges. Because the content provider is improperly secured, any third-party application installed on the device can interact with it to perform file operations (read, write, delete) as the system user. This allows for the unauthorized extraction of PII, including SMS messages and call logs, by bypassing the Android permission model.

Affected products

BLU R1 HD Shanghai Adups software

Timeline

2016-11-16: disclosed: Public media coverage of Adups software issues
2017-01-13: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.