CVE-2016-4288 — HIGH (8.4) — White Hats Nepal

Vulnerability Description

A local privilege escalation vulnerability exists in BlueStacks App Player. The BlueStacks App Player installer creates a registry key with weak permissions that allows users to execute arbitrary programs with SYSTEM privileges.

CVSS Score

8.4

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Bluestacks	Bluestacks	2.1.3.5650

Related Weaknesses (CWE)

CWE-275

References

http://www.talosintelligence.com/reports/TALOS-2016-0124/ExploitMitigationTechnical Description
http://www.securityfocus.com/bid/92426Third Party AdvisoryVDB Entry
http://www.talosintelligence.com/reports/TALOS-2016-0124/ExploitMitigationTechnical Description

FAQ

What is CVE-2016-4288?

CVE-2016-4288 is a vulnerability with a CVSS score of 8.4 (HIGH). A local privilege escalation vulnerability exists in BlueStacks App Player. The BlueStacks App Player installer creates a registry key with weak permissions that allows users to execute arbitrary prog...

How severe is CVE-2016-4288?

CVE-2016-4288 has been rated HIGH with a CVSS base score of 8.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2016-4288?

Check the references section above for vendor advisories and patch information. Affected products include: Bluestacks Bluestacks.