JVN#60702986
BlueStacks App Player fails to restrict access permissions
Overview
BlueStacks App Player fails to restrict access permissions.
Products Affected
- BlueStacks App Player for Windows 3.0.0 to 4.31.55
- BlueStacks App Player for macOS 2.0.0 and later
Description
BlueStacks App Player fails to restrict access permissions (CWE-284).
Impact
A user with access to the network that is connected to the affected product may gain unauthorized access.
Solution
Update the Software
Windows users should update to the latest version of software according to the information provided by the developer.
Apply Workarounds
macOS users should apply the following workarounds to mitigate the effects of this vulnerability.
- Do not connect BlueStacks installed machine to the network
- Block access from outside to 5555/TCP
Vendor Status
| Vendor | Link |
| BlueStacks | BlueStacks fails to restrict access permissions |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Credit
Masaki Kubo and Yoshiki Mori of Cybersecurity Laboratory, National Institute of Information and Communications Technology reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2018-0701 |
| JVN iPedia |
JVNDB-2018-000111 |
Update History
- 2018/10/30
- Fixed an error under [Products Affected]