CVE-2013-6774
Summary
| CVE | CVE-2013-6774 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-03-31 14:58:57 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | Untrusted search path vulnerability in the ChainsDD Superuser package 3.1.3 for Android 4.2.x and earlier, CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier, and Chainfire SuperSU package before 1.69 for Android 4.2.x and earlier allows attackers to load an arbitrary .jar file and gain privileges via a crafted BOOTCLASSPATH environment variable for a /system/xbin/su process. NOTE: another researcher was unable to reproduce this with ChainsDD Superuser. |
Risk And Classification
Primary CVSS: v2.0 10 from [email protected]
AV:N/AC:L/Au:N/C:C/I:C/A:C
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:N/AC:L/Au:N/C:C/I:C/A:C
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Androidsu | Chainsdd Superuser | 3.1.3 | All | All | All |
| Application | Chainfire | Supersu | 1.69 | All | All | All |
| Operating System | Android | 1.0 | All | All | All | |
| Operating System | Android | 1.1 | All | All | All | |
| Operating System | Android | 1.5 | All | All | All | |
| Operating System | Android | 1.6 | All | All | All | |
| Operating System | Android | 2.0 | All | All | All | |
| Operating System | Android | 2.0.1 | All | All | All | |
| Operating System | Android | 2.1 | All | All | All | |
| Operating System | Android | 2.2 | All | All | All | |
| Operating System | Android | 2.2 | rev1 | All | All | |
| Operating System | Android | 2.2.1 | All | All | All | |
| Operating System | Android | 2.2.2 | All | All | All | |
| Operating System | Android | 2.2.3 | All | All | All | |
| Operating System | Android | 2.3 | All | All | All | |
| Operating System | Android | 2.3 | rev1 | All | All | |
| Operating System | Android | 2.3.1 | All | All | All | |
| Operating System | Android | 2.3.2 | All | All | All | |
| Operating System | Android | 2.3.3 | All | All | All | |
| Operating System | Android | 2.3.4 | All | All | All | |
| Operating System | Android | 2.3.5 | All | All | All | |
| Operating System | Android | 2.3.6 | All | All | All | |
| Operating System | Android | 2.3.7 | All | All | All | |
| Operating System | Android | 3.0 | All | All | All | |
| Operating System | Android | 3.1 | All | All | All | |
| Operating System | Android | 3.2 | All | All | All | |
| Operating System | Android | 3.2.1 | All | All | All | |
| Operating System | Android | 3.2.2 | All | All | All | |
| Operating System | Android | 3.2.4 | All | All | All | |
| Operating System | Android | 3.2.6 | All | All | All | |
| Operating System | Android | 4.0 | All | All | All | |
| Operating System | Android | 4.0.1 | All | All | All | |
| Operating System | Android | 4.0.2 | All | All | All | |
| Operating System | Android | 4.0.3 | All | All | All | |
| Operating System | Android | 4.0.4 | All | All | All | |
| Operating System | Android | 4.1 | All | All | All | |
| Operating System | Android | 4.1.2 | All | All | All | |
| Operating System | Android | 4.2 | All | All | All | |
| Operating System | Android | 4.2.1 | All | All | All | |
| Operating System | Android | 4.2.2 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Exploit |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.