Multiple HTC devices 'HtcLoggers.apk' Application Information Disclosure Vulnerability

Bugtraq ID:	49916
Class:	Design Error
CVE:	CVE-2011-3975
Remote:	Yes
Local:	No
Published:	Oct 03 2011 12:00AM
Updated:	Oct 05 2011 03:50PM
Credit:	Trevor Eckhart
Vulnerable:	HTC Thunderbolt 0 HTC MyTouch 4G Slide 0 HTC EVO View 4G 0 HTC EVO Shift 4G 0 HTC EVO 4G 0 HTC EVO 3D 0
Not Vulnerable:

Multiple HTC devices 'HtcLoggers.apk' Application Information Disclosure Vulnerability

Multiple HTC devices are prone to an information-disclosure vulnerability that affects the 'HtcLoggers.apk' application.

An attacker can exploit this issue by enticing an unsuspecting victim to install a malicious application with INTERNET ('android.permission.INTERNET') permissions, on the device running Android.

Remote attackers can exploit this issue to gain access to sensitive information. This may aid in further attacks.

Multiple HTC devices 'HtcLoggers.apk' Application Information Disclosure Vulnerability

An exploit application and a video demonstrating the attack is available. Please see the references for more information.

Multiple HTC devices 'HtcLoggers.apk' Application Information Disclosure Vulnerability

References:

• Massive Security Vulnerability In HTC Android Devices (EVO 3D, 4G, Thunderbolt, (Android Police)
  
• Vendor Homepage (HTC)