CVE-2013-6770
HighSummary
The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.3 and 4.4 does not properly restrict the set of users who can execute /system/xbin/su with the --daemon option. This allows attackers to gain privileges by leveraging ADB shell access and a certain Linux UID, and then creating a Trojan horse script.
Risk Assessment
Organizations may be exposed to unauthorized access to the system, potentially leading to serious security breaches and data loss. Attackers can exploit this vulnerability to escalate privileges and introduce malicious software.
Recommendation
It is recommended to update the Superuser package to the latest version that fixes this vulnerability. Additionally, access to ADB should be restricted and user permissions in the system should be monitored.
Other vulnerabilities in CyanogenMod/ClockWorkMod/Koush Superuser package
Original NVD description (English source)
The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.3 and 4.4 does not properly restrict the set of users who can execute /system/xbin/su with the --daemon option, which allows attackers to gain privileges by leveraging ADB shell access and a certain Linux UID, and then creating a Trojan horse script.