Android 4.4 MTP Path Traversal

Discussion in 'News Aggregator' started by Packet Storm, 20 Apr 2015.

  1. Packet Storm

    Packet Storm Guest

    The doSendObjectInfo() method of the MtpServer class implemented in frameworks/av/media/mtp/MtpServer.cpp on Android 4.4 does not validate the name parameter of the incoming MTP packet, leading to a path traversal vulnerability.

    Continue reading...
     
    #1 Packet Storm, 20 Apr 2015
(You must log in or sign up to post here.)

Share This Page

Loading...