CVE-2019-15743 : Security Advisory and Response

The Sony Xperia Touch Android device is vulnerable to a confused deputy attack, allowing unauthorized recording of microphone audio by any installed application.

Understanding CVE-2019-15743

The security vulnerability in the Sony Xperia Touch Android device enables unauthorized access to the microphone for audio recording.

What is CVE-2019-15743?

The CVE-2019-15743 vulnerability involves a pre-installed application on the Sony Xperia Touch device that permits unauthorized recording of microphone audio by any app on the device.

The Impact of CVE-2019-15743

The exploit allows third-party applications to record audio and save it to external storage without user consent, posing a significant privacy risk.

Technical Details of CVE-2019-15743

The technical aspects of the CVE-2019-15743 vulnerability are as follows:

Vulnerability Description

The vulnerable app, com.sonymobile.android.maintenancetool.testmic, allows unauthorized microphone audio recording.

Affected Systems and Versions

Sony Xperia Touch Android device with the specified build fingerprint and app version (versionCode=24, versionName=7.0).

Exploitation Mechanism

The confused deputy attack enables any app on the device to access and record microphone audio without user authorization.

Mitigation and Prevention

Protect your device from CVE-2019-15743 with the following measures:

Immediate Steps to Take

Disable the vulnerable app or revoke its microphone permissions.
Regularly monitor app permissions and restrict unnecessary access.

Long-Term Security Practices

Keep your device updated with the latest security patches.
Be cautious when granting permissions to apps and review their access requirements.

Patching and Updates

Install firmware updates provided by Sony to address the security vulnerability.