Is CVE-2016-10139 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-10139 being exploited in the wild.

How severe is CVE-2016-10139?

High severity, with a CVSS score of 7.8, published 13 January 2017.

Which products and versions are affected?

BLU R1 HD Shanghai Adups software.

Is there a fix for CVE-2016-10139?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2016-10139 attacked?

It is attacked with local access, in device firmware.

Am I affected by CVE-2016-10139?

Check whether you run Adups Fota or BLU R1 HD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-10139: BLU R1 HD Privilege Escalation and Data Exfiltration in Adups FOTA

CVE-2016-10139 · Severity: high · CVSS 7.8 · Published 2017-01-13

A security issue was identified in BLU R1 HD mobile devices using Shanghai Adups software, which is responsible for wireless updates. The software contains components that run with high-level system privileges, allowing it to bypass standard security protections. This enables the silent collection and transmission of sensitive user data, including text messages, call logs, and device identifiers, to external servers without the user's knowledge or consent.

Technologies: Adups Fota, BLU R1 HD. Vendors: Adups, BLU.

Quick answers

Is CVE-2016-10139 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-10139 being exploited in the wild.
How severe is CVE-2016-10139?: High severity, with a CVSS score of 7.8, published 13 January 2017.
Which products and versions are affected?: BLU R1 HD Shanghai Adups software.
Is there a fix for CVE-2016-10139?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-10139 attacked?: It is attacked with local access, in device firmware.
Am I affected by CVE-2016-10139?: Check whether you run Adups Fota or BLU R1 HD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists within the Shanghai Adups FOTA (Firmware Over-The-Air) update software on BLU R1 HD devices. The component 'com.adups.fota.sysoper' incorrectly uses the 'android:sharedUserId' attribute set to 'android.uid.system', granting it pervasive system-level permissions. This component acts as a provider ('com.adups.fota.sysoper.provider.InfoProvider') that allows the 'com.adups.fota' app to access sensitive data including SMS content, call logs, and IMSI/IMEI identifiers. The software is designed to exfiltrate this personally identifiable information (PII) every 72 hours, triggered by system events such as charging or network changes, without user interaction.

Affected products

BLU R1 HD Shanghai Adups software

Timeline

2016-11-16: disclosed: Public media coverage of the Adups software behavior
2017-01-13: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.