NVD Vulnerability Detail

CVE-2020-7705

Summary	This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attribution fraud. Mintegral can remotely activate hooks on the UIApplication, openURL, SKStoreProductViewController, loadProductWithParameters and NSURLProtocol methods along with anti-debug and proxy detection protection. If those hooks are active MintegralAdSDK sends obfuscated data about every opened URL in an application to their servers. Note that the malicious functionality is enabled even if the SDK was not enabled to serve ads.
Publication Date	Aug. 25, 2020, 3:15 a.m.
Registration Date	Jan. 26, 2021, 12:01 p.m.
Last Update	Nov. 21, 2024, 2:37 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:mintegral:mintegraladsdk::::::::		0.0.0

Related information, measures and tools

No	URL	タグ
1	https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/	Third Party Advisory
2	https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/	Third Party Advisory
3	https://snyk.io/research/sour-mint-malicious-sdk/	Third Party Advisory
4	https://snyk.io/research/sour-mint-malicious-sdk/	Third Party Advisory
5	https://snyk.io/vuln/SNYK-COCOAPODS-MINTEGRALADSDK-598852	Third Party Advisory
6	https://snyk.io/vuln/SNYK-COCOAPODS-MINTEGRALADSDK-598852	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-1021	レンダリングされたユーザインターフェースレイヤまたはフレームの不適切な制限	https://cwe.mitre.org/data/definitions/1021.html

JVN Vulnerability Information

MintegralAdSDK におけるレンダリングされたユーザインターフェースレイヤまたはフレームの不適切な制限に関する脆弱性

Title	MintegralAdSDK におけるレンダリングされたユーザインターフェースレイヤまたはフレームの不適切な制限に関する脆弱性
Summary	MintegralAdSDK には、レンダリングされたユーザインターフェースレイヤまたはフレームの不適切な制限に関する脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Aug. 18, 2020, midnight
Registration Date	Jan. 7, 2021, 3:32 p.m.
Last Update	Jan. 7, 2021, 3:32 p.m.

Affected System

Mintegral

MintegralAdSDK

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-7705	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7705
National Vulnerability Database (NVD)
2	CVE-2020-7705	https://nvd.nist.gov/vuln/detail/CVE-2020-7705

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-1021	https://cwe.mitre.org/data/definitions/1021.html

ベンダー情報

No	Name	URL
Github
1	Mintegral-official/MintegralAdSDK-iOS-new	https://github.com/Mintegral-official/MintegralAdSDK-iOS-new

その他

No	Name	URL
関連文書
1	SNYK-COCOAPODS-MINTEGRALADSDK-598852 (Affecting mintegraladsdk package, versions <6.6.0.0)	https://snyk.io/vuln/SNYK-COCOAPODS-MINTEGRALADSDK-598852
2	SourMint: malicious code, ad fraud, and data leak in iOS	https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/

Change Log

No	Changed Details	Date of change
1	[2021年01月07日] 掲載	Jan. 7, 2021, 3:32 p.m.