CVE-2020-12717 (GCVE-0-2020-12717)

Vulnerability from cvelistv5 – Published: 2020-05-14 04:36 – Updated: 2024-08-04 12:04
VLAI?
Summary
The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. The ABTraceTogether (Alberta), ProteGO (Poland), and TraceTogether (Singapore) apps were also affected.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:04:22.554Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://medium.com/%40wabz/covidsafe-ios-vulnerability-cve-2020-12717-30dc003f9708"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. The ABTraceTogether (Alberta), ProteGO (Poland), and TraceTogether (Singapore) apps were also affected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-05-14T04:36:11",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://medium.com/%40wabz/covidsafe-ios-vulnerability-cve-2020-12717-30dc003f9708"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-12717",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. The ABTraceTogether (Alberta), ProteGO (Poland), and TraceTogether (Singapore) apps were also affected."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://medium.com/@wabz/covidsafe-ios-vulnerability-cve-2020-12717-30dc003f9708",
              "refsource": "MISC",
              "url": "https://medium.com/@wabz/covidsafe-ios-vulnerability-cve-2020-12717-30dc003f9708"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-12717",
    "datePublished": "2020-05-14T04:36:11",
    "dateReserved": "2020-05-07T00:00:00",
    "dateUpdated": "2024-08-04T12:04:22.554Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:alberta:abtracetogether:-:*:*:*:*:iphone_os:*:*\", \"matchCriteriaId\": \"35FD1BAA-06DA-4048-9175-7B6305FA90F2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gov:protego_safe:-:*:*:*:*:iphone_os:*:*\", \"matchCriteriaId\": \"3670D0D0-0043-4575-887B-CD75EA4BEB26\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:health:covidsafe:1.0:*:*:*:*:iphone_os:*:*\", \"matchCriteriaId\": \"39EB4CCA-71AA-4DE7-A3FE-5A535E9C34B9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:health:covidsafe:1.1:*:*:*:*:iphone_os:*:*\", \"matchCriteriaId\": \"94AB46DD-B889-4072-B63F-561E663C5FBD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:tracetogether:tracetogether:-:*:*:*:*:iphone_os:*:*\", \"matchCriteriaId\": \"39F397CD-004A-46A4-8EC1-33D26F2E3DD2\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. The ABTraceTogether (Alberta), ProteGO (Poland), and TraceTogether (Singapore) apps were also affected.\"}, {\"lang\": \"es\", \"value\": \"La aplicaci\\u00f3n COVIDSafe (Australia) versiones 1.0 y 1.1 para iOS, permite a un atacante remoto bloquear la aplicaci\\u00f3n, y en consecuencia interferir con el rastreo de contactos de COVID-19, por medio de un anuncio de Bluetooth que contiene datos del fabricante que son muy cortos. Esto se presenta debido a una llamada err\\u00f3nea de OpenTrace manuData.subdata. Las aplicaciones ABTraceTogether (Alberta), ProteGO (Polonia), y TraceTogether (Singapur) tambi\\u00e9n estaban afectadas.\"}]",
      "id": "CVE-2020-12717",
      "lastModified": "2024-11-21T05:00:08.237",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:A/AC:L/Au:N/C:N/I:N/A:P\", \"baseScore\": 3.3, \"accessVector\": \"ADJACENT_NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 6.5, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2020-05-14T05:15:10.987",
      "references": "[{\"url\": \"https://medium.com/%40wabz/covidsafe-ios-vulnerability-cve-2020-12717-30dc003f9708\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://medium.com/%40wabz/covidsafe-ios-vulnerability-cve-2020-12717-30dc003f9708\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2020-12717\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2020-05-14T05:15:10.987\",\"lastModified\":\"2024-11-21T05:00:08.237\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. The ABTraceTogether (Alberta), ProteGO (Poland), and TraceTogether (Singapore) apps were also affected.\"},{\"lang\":\"es\",\"value\":\"La aplicaci\u00f3n COVIDSafe (Australia) versiones 1.0 y 1.1 para iOS, permite a un atacante remoto bloquear la aplicaci\u00f3n, y en consecuencia interferir con el rastreo de contactos de COVID-19, por medio de un anuncio de Bluetooth que contiene datos del fabricante que son muy cortos. Esto se presenta debido a una llamada err\u00f3nea de OpenTrace manuData.subdata. Las aplicaciones ABTraceTogether (Alberta), ProteGO (Polonia), y TraceTogether (Singapur) tambi\u00e9n estaban afectadas.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:A/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":3.3,\"accessVector\":\"ADJACENT_NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.5,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:alberta:abtracetogether:-:*:*:*:*:iphone_os:*:*\",\"matchCriteriaId\":\"35FD1BAA-06DA-4048-9175-7B6305FA90F2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gov:protego_safe:-:*:*:*:*:iphone_os:*:*\",\"matchCriteriaId\":\"3670D0D0-0043-4575-887B-CD75EA4BEB26\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:health:covidsafe:1.0:*:*:*:*:iphone_os:*:*\",\"matchCriteriaId\":\"39EB4CCA-71AA-4DE7-A3FE-5A535E9C34B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:health:covidsafe:1.1:*:*:*:*:iphone_os:*:*\",\"matchCriteriaId\":\"94AB46DD-B889-4072-B63F-561E663C5FBD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tracetogether:tracetogether:-:*:*:*:*:iphone_os:*:*\",\"matchCriteriaId\":\"39F397CD-004A-46A4-8EC1-33D26F2E3DD2\"}]}]}],\"references\":[{\"url\":\"https://medium.com/%40wabz/covidsafe-ios-vulnerability-cve-2020-12717-30dc003f9708\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://medium.com/%40wabz/covidsafe-ios-vulnerability-cve-2020-12717-30dc003f9708\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.