Evernote For Android CVE-2013-5116 Local Security Bypass Vulnerabiliy

Bugtraq ID:	64320
Class:	Design Error
CVE:	CVE-2013-5116
Remote:	No
Local:	Yes
Published:	Dec 12 2013 12:00AM
Updated:	Dec 12 2013 12:00AM
Credit:	Chris John Riley
Vulnerable:	Evernote Evernote 5.5 Evernote Evernote 4.5.1.5432
Not Vulnerable:	Evernote Evernote 5.5.1

Evernote For Android CVE-2013-5116 Local Security Bypass Vulnerabiliy

Evernote for Android is prone to a local security-bypass vulnerability.

Attackers with physical access to device can exploit this issue to gain access to password, bypass certain security restrictions, and perform unauthorized actions; this may aid in launching further attacks.

Versions prior to Evernote for Android 5.5.1 are vulnerable.

Evernote For Android CVE-2013-5116 Local Security Bypass Vulnerabiliy

An attacker with physical access to the device can exploit this issue.

Evernote For Android CVE-2013-5116 Local Security Bypass Vulnerabiliy

Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.

Evernote For Android CVE-2013-5116 Local Security Bypass Vulnerabiliy

References:

• [CVE-2013-5116] Evernote Android Insecure Password Change (one-click setup) (Chris John Riley)
  
• Evernote for Android Homepage (Evernote)
  
• Evernote Security (Evernote)