CVE-2019-2102 — Android vulnerability

CWE-2646 documents4 sources
Severity
8.8HIGHNVD
EPSS
0.1%
top 73.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Apple IOSApple Macos Mojave 10.14.5 Security Update 2019-003 High Sierra Security Update 2019-0Apple Tvos+2 more
Timeline
PublishedJun 7
Latest updateMay 24

Description

In the Bluetooth Low Energy (BLE) specification, there is a provided example Long Term Key (LTK). If a BLE device were to use this as a hardcoded LTK, it is theoretically possible for a proximate attacker to remotely inject keystrokes on a paired Android host due to improperly used crypto. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-128843052.

CVSS vector

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages6 packages

▶NVDgoogle/android6 versions+5
▶CVEListV5android/androidAndroid-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9
▶Appleapple/ios12.3
▶Appleapple/tvos12.3

🔴Vulnerability Details

1
GHSA
GHSA-5jf8-vrfc-7fr9: In the Bluetooth Low Energy (BLE) specification, there is a provided example Long Term Key (LTK)↗2022-05-24
▶

📋Vendor Advisories

4
Android
CVE-2019-2102: Android Security Bulletin 2019-06-01 CVE: CVE-2019-2102 Severity: HIGH Type: EoP Affected AOSP versions: 7↗2019-06-01
▶
Apple
CVE-2019-2102: iOS 12.3↗2019-05-13
▶
Apple
CVE-2019-2102: tvOS 12.3↗2019-05-13
▶
Apple
CVE-2019-2102: macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra↗2019-05-13
▶