CVE-2017-13266:

Stack corruption vulnerability in Android's Bluetooth AVRC parsing component allows remote code execution.

Score
A numerical rating that indicates how dangerous this vulnerability is.

9.8Critical

Published Date:Apr 4, 2018
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:1.3
EPSS Percentile:79%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Stack corruption vulnerability in Android's Bluetooth AVRC parsing component allows remote code execution.

Overview

This vulnerability (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) exists in the Bluetooth stack of Android devices. The specific issue is in the AVRCP component that handles vendor commands. When processing these commands, the code fails to properly validate input boundaries, which can lead to stack corruption. An attacker within Bluetooth range could exploit this vulnerability to execute malicious code with the privileges of the Bluetooth service. The attack doesn't require user interaction or special permissions, making it particularly dangerous. All Android devices running versions 5.1.1 through 8.1 are affected.

Remediation

Users should update their Android devices to the latest security patch level. Google addressed this vulnerability in the March 2018 Android Security Bulletin. The following actions are recommended:
1. Check your current Android version and security patch level under Settings > About phone > Android version and Security patch level.
2. Enable automatic system updates if available.
3. Apply all pending system updates immediately.
4. If updates are not available for your device, consider disabling Bluetooth when not in use to reduce the attack surface.
5. Only connect to trusted Bluetooth devices and avoid pairing in public locations where attackers might be present.