Evernote For Android CVE-2013-5112 Multiple Local Security Bypass Vulnerabilities

Bugtraq ID:	64316
Class:	Design Error
CVE:	CVE-2013-5112
Remote:	No
Local:	Yes
Published:	Dec 12 2013 12:00AM
Updated:	Dec 12 2013 12:00AM
Credit:	Chris John Riley
Vulnerable:	Evernote Evernote 5.5 Evernote Evernote 4.5.1.5432
Not Vulnerable:	Evernote Evernote 5.5.1

Evernote For Android CVE-2013-5112 Multiple Local Security Bypass Vulnerabilities

Evernote for Android is prone to multiple local security-bypass vulnerabilities.

Attackers with physical access to device can exploit these issues to bypass certain security restrictions, recover the PIN and perform unauthorized actions; this may aid in launching further attacks.

Versions prior to Evernote for Android 5.5.1 are vulnerable.

Evernote For Android CVE-2013-5112 Multiple Local Security Bypass Vulnerabilities

An attacker with physical access to the device can exploit these issues.

Evernote For Android CVE-2013-5112 Multiple Local Security Bypass Vulnerabilities

Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.

Evernote For Android CVE-2013-5112 Multiple Local Security Bypass Vulnerabilities

References:

• [CVE-2013-5112] Evernote Android Insecure Storage of PIN data / Bypass of PIN pr (Chris John Riley)
  
• Evernote for Android Homepage (Evernote)
  
• Evernote Security (Evernote)