CVE-2019-14220 : What You Need to Know

A vulnerability was found in BlueStacks versions 4.110 and earlier for macOS, and versions 4.120 and earlier for Windows. BlueStacks utilizes a virtual machine (VM) running Android, allowing Android apps to be run on Windows or MacOS. The bug involves a local arbitrary file read performed through a system service call. The vulnerable method operates with System admin privilege and, when provided with a file name as a parameter, it retrieves the content of the file. Exploiting this vulnerability, a malicious app can read the content of any system file that it does not have authorization to access.

Understanding CVE-2019-14220

BlueStacks vulnerability impacting versions 4.110 and below on macOS, and versions 4.120 and below on Windows.

What is CVE-2019-14220?

This CVE identifies a security flaw in BlueStacks that allows a malicious app to read unauthorized system files through a local arbitrary file read method.

The Impact of CVE-2019-14220

Malicious apps can access sensitive system files without proper authorization.

Technical Details of CVE-2019-14220

BlueStacks vulnerability technical specifics.

Vulnerability Description

The bug allows unauthorized access to system files through a local arbitrary file read method in BlueStacks.

Affected Systems and Versions

BlueStacks versions 4.110 and earlier on macOS
BlueStacks versions 4.120 and earlier on Windows

Exploitation Mechanism

Utilizes a system service call to perform a local arbitrary file read
Operates with System admin privilege
Retrieves file content when provided with a file name as a parameter

Mitigation and Prevention

Steps to address and prevent the CVE-2019-14220 vulnerability.

Immediate Steps to Take

Update BlueStacks to the latest version that includes a patch for the vulnerability
Avoid running untrusted apps on BlueStacks

Long-Term Security Practices

Regularly update software and applications to patch known vulnerabilities
Implement access controls to restrict app permissions

Patching and Updates

Check for and apply security patches released by BlueStacks to address the vulnerability