Published:2014/03/18  Last Updated:2014/03/18

sp mode mail issue where emails in the process of creation may be accessed


sp mode mail provided by NTT DOCOMO contains an issue where emails may be accessed while in the process of being created.

Products Affected

  • sp mode mail rev.6100 through rev.6300 for Android 4.0.X and earlier
  • sp mode mail rev.6130 through rev.6700 for Android 4.1 and later


sp mode mail provided by NTT DOCOMO contains an application link interface so that mail data can be exchanged with external application during email creation. When the application to be linked is selected, the email contents and attachment are saved to the SD card, therefore other Android applications may access this data.


If a malicious Android application is installed on the device, contents of emails being created may be obtained.


An update to address this issue will not be provided by the developer.

Note on usage:
According to the developer, a warning about this issue has been included in the consents agreement that is displayed when launching the application for the first time, the pop-up when using this application link interface for the first time and the help page for this product in sp mode mail rev.6400 and later for Android 4.0.X and earlier and sp mode mail rev.6800 and later for Android 4.1 and later.

Vendor Status

Vendor Status Last Update Vendor Notes
NTT DOCOMO, INC. Vulnerable 2014/03/18


JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Analyzed on 2014.03.18

Measures Conditions Severity
Access Required can be attacked over the Internet using packets
  • High
Authentication anonymous or no authentication (IP addresses do not count)
  • High
User Interaction Required the user must be convinced to take a difficult or suspicious action. If the honest user must have elevated privileges, they are likely to be more suspicious
  • Low
Exploit Complexity some expertise and/or luck required (most buffer overflows, guessing correctly in small space, expertise in Windows function calls)
  • Mid-High

Description of each analysis measures


This analysis assumes that the user is tricked into installing a malicious application.


Hironori Tokuta reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Reports
CERT Advisory
CPNI Advisory
CVE CVE-2014-1978
JVN iPedia JVNDB-2014-000028