Google Android CVE-2017-0785 Information Disclosure Vulnerability

Bugtraq ID:	100812
Class:	Unknown
CVE:	CVE-2017-0785
Remote:	Yes
Local:	No
Published:	Sep 12 2017 12:00AM
Updated:	Sep 12 2017 12:00AM
Credit:	Ben Seri and Gregory Vishnepolsky of Armis.
Vulnerable:	Google Pixel XL 0 Google Pixel C 0 Google Pixel 0 Google Nexus Player 0 Google Nexus 9 Google Nexus 6P Google Nexus 6 Google Nexus 5X Google Android 7.1.1 Google Android 6.0.1 Google Android 5.1.1 Google Android 5.0.2 Google Android 4.4.4 Google Android 8.0 Google Android 7.1.2 Google Android 7.0 Google Android 6.0
Not Vulnerable:

Google Android CVE-2017-0785 Information Disclosure Vulnerability

Google Android is prone to an information disclosure vulnerability.

An attacker can exploit this issue to obtain potentially sensitive information.

This issue is being tracked by Android Bug ID A-63146698.

Google Android CVE-2017-0785 Information Disclosure Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

Google Android CVE-2017-0785 Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Google Android CVE-2017-0785 Information Disclosure Vulnerability

References:

• Android Homepage (Google)
  
• The dangers of Bluetooth implementations: Unveiling zero day vulnerabilities (Ben Seri ??& Gregory Vishnepolsky)
  
• The IoT Attack Vector �??BlueBorne�?� Exposes Almost Every Connected Device (Armis)
  
• Android Security Bulletin�??September 2017 (Google)
  
• VU#240311 Multiple Bluetooth implementation vulnerabilities affect many devices (CERT)