Description (CNA)
signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due to incorrect checks and the missing installation of the signon-apparmor-extension. An attacker could use this create a malicious click app that collects oauth tokens for other applications, exposing sensitive information.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Ubuntu / signon | affected Ubuntu 15.04 signon before 8.57+15.04.20141127.1-0ubuntu1 |
CWE
CWE-522
References
- http://bazaar.launchpad.net/~online-accounts/signon/upstream/revision/644
- http://bazaar.launchpad.net/~online-accounts/signon/upstream/revision/645
- https://bugs.launchpad.net/ubuntu/+source/signon/+bug/1392380
ADP enrichment
No English description supplied.