CVE-2013-5113: 
LastPass vulnerability analysis and mitigation

CVE-2013-5113 affects LastPass Android application versions prior to 2.5.1, involving an insecure PIN implementation. The vulnerability was discovered and reported by security researcher Chris Riley, with the disclosure date being September 5, 2013 (Security Blog).

The vulnerability exists in the PIN protection mechanism of LastPass Android application. The issue stems from the application's configuration settings being accessible through Android's backup functionality due to android:allBackup being set to True. This allows an attacker with physical access to the device to manipulate PIN-related settings through ADB backup and restore operations, even on non-rooted devices with USB debugging enabled (Security Blog).

An attacker with physical access to the device could bypass the PIN protection mechanism, access stored passwords, and potentially maintain persistent access to the victim's LastPass account until the master password is changed. Additionally, the attacker could clone the LastPass container to another device and receive updates whenever the victim updates their stored passwords (Security Blog).

The vulnerability requires physical access to the device with USB debugging enabled. The attack can be executed within 30 seconds, allowing an attacker to backup the LastPass configuration, modify it, and restore it to bypass security measures. The exploit does not require root access to the device (Security Blog).

LastPass addressed this vulnerability in version 2.5.1 by disabling the allowBackup feature. Users should upgrade to version 2.5.1 or later to protect against this vulnerability (Security Blog).