CheckPoint Finds An RCE Vulnerability Affecting Millions of Devices



Israel-based cyber security company CheckPointdiscovered a vulnerability that could allow code execution on millions of devices.

CheckPoint researchers According to the details he shared with The Hacker News These vulnerabilities, located in the RCE (Remote Code Execution) type, allow attackers to access data without the need to execute any malware on their targets.

In addition, the privileges of Android applications running with low rights can be upgraded.

ALLHACK vulnerabilities caused by the open source lossless audio codec called ALAC (Apple Lossless Audio Codec), developed by Apple in 2011, are used by Qualcomm and MediaTek.



Also read: Google has finally found a real purpose with its new augmented reality glasses… just like the Apple and its Watch

While the vulnerabilities in the proprietary versions of ALAC are constantly being patched by Apple, the open source version used by the chip manufacturers does not seem to have been updated since 2011.

According to CheckPoint’s post Two of the vulnerabilities affect MediaTek and one affects Qualcomm chips.

  • CVE-2021-0674 (MediaTek): Information disclosure on ALAC codecs without any user intervention
  • CVE-2021-0675 (MediaTek): LPE vulnerability using ALAC codecs
  • CVE-2021-30351 (Qualcomm): Out-of bound memory access vulnerability caused by incorrect validation during audio playback

While these vulnerabilities were reported to be patched by CheckPoint in December 2021, Qualcomm and MediaTek have already released security updates for the devices.

Those who have not yet updated their devices at the moment do not need to do anything else to close the gap, except to apply software updates.



Related News

Sitecore: Italian consumers ask for authenticity and empathy

In the last two years, consumers have profoundly changed their purchasing habitsinitially driven by the state of emergency, to then benefit from the

‘Teenage Mutant Ninja Turtles: Shredder’s Revenge’ is a great beat-em-up revival

If you went to arcades in the late '80s or early '90s, you definitely remember the golden age of beat-em-up games. like cabinets teenage Mutant Ninja Turtles,

Netflix confirms that an ad-supported tier is indeed happening

Netflix co-CEO Ted Sarandos has confirmed that the company plans to introduce an ad-supported tier for its streaming service in an interview at the Cannes

CTS-D is a new compatibility test suite module containing tests submitted by Android app developers

As part of the Android Compatibility Program, Google provides smartphone OEMs with access to the Compatibility Test Suite (CTS). The suite includes a

How to tell if Update Apple ID Settings message is valid?

For reasons best known only to Apple, you may from time to time or even frequently see a message that says:

apple, please stop killing the things we hate

Apple is known for its tendency to kill its own kids, but it's easy to overlook the sad number of shoddy rival offerings the company has killed along the way.