Is my Android device vulnerable to CVE-2019-2234 and How can I mitigate this before a firmware upgrade?
1
vote
1
answer
363
views
>**Background Info:** CVE-2019-2234 is a serious vulnerability or (maybe an APT) which allow other apps to record videos, take pictures, and extract EXIF data without having permissions.
>
>**Edit:** This question is other devices rather than Pixel & Samsung
I've tested this PoC (changed package name to my camera's package name) to check if is this possible on my (non Pixel) device, but all I have is the camera activity has been launched without starting recording or taking pictures.
**Launch Camera:**
adb shell am start-activity -n com.android.camera/com.android.camera.CameraActivity --ez extra_turn_screen_on true -a android.media.action.CAMERA --ez android.intent.extra.USE_FRONTAL_CAMERA true
**Launch Video:**
adb shell am start-activity -n com.android.camera/com.android.camera.CameraActivity --ez extra_turn_screen_on true -a android.media.action.VIDEO_CAMERA --ez android.intent.extra.USE_FRONTAL_CAMERA true
**Question**
**Part 1:** If this device is vulnerable are there other extras to add to make the PoC work and proof that it's vulnerable? or just it's not?
**Part 2:** If the device is vulnerable, what would be the best mitigation solution for this?
Asked by M. A.
(840 rep)
Nov 21, 2019, 08:08 AM
Last activity: Nov 21, 2019, 12:53 PM
Last activity: Nov 21, 2019, 12:53 PM