Showing posts with label Vulnerablity. Show all posts

Samsung Kies Remote Command Execution


Samsung Kies
Samsung Kies
Samsung Kies is a software application used for communication between Windows/Mac computers, mobile phones and tablets. Communication can be performed via USB on traditional devices or via WiFi on newer devices. The software has a number of functions, including data backup, data transfer, multimedia management and firmware/OS upgrade.
An arbitrary command execution vulnerability exists in Samsung Kies. The vulnerability is due to insufficient validation of incoming requests.

A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to access a malicious web site. This can result in arbitrary command execution in the context of the affected user.

Samsung has released a new version which can be obtained from their website:

Description of Vulnerability:


Samsung Kies is a software application used for communication between Windows/Mac computers, mobile phones and tablets. Communication can be performed via USB on traditional devices or via WiFi on newer devices. The software has a number of functions, including data backup, data transfer, multimedia management and firmware/OS upgrade.
Upon installation, Kies deploys an ActiveX control CmdAgent.CommandAgent which is contained in dynamic-link library CmdAgent.dll. The ActiveX control can be instantiated via a web page.

A remote command execution vulnerability exists in Samsung Kies. Specifically the vulnerability is due to exposure of unsafe methods in the CmdAgent.CommandAgent ActiveX control. A remote attackers can exploit this vulnerability by enticing a target user (who has Samsung Kies installed) to open a specially crafted web page. Successful exploitation of this flaw allows arbitrary command execution in the security context of the logged-in user.

Exploit-Db Report about "Samsung Kies Remote Command Execution"
http://www.exploit-db.com/exploits/22007/