Android Web Browser GIF File Heap-Based Buffer Overflow Vulnerability

Bugtraq ID:	28005
Class:	Boundary Condition Error
CVE:	CVE-2008-0985
Remote:	Yes
Local:	No
Published:	Mar 04 2008 12:00AM
Updated:	Mar 04 2008 07:22PM
Credit:	Alfredo Ortega and his 'Pampa Grande' Team from Core Security Technologies are credited with discovering this issue.
Vulnerable:	Google Android Software Development Kit (SDK) m3-rc37a
Not Vulnerable:	Google Android Software Development Kit (SDK) m5-rc15

Android Web Browser GIF File Heap-Based Buffer Overflow Vulnerability

Android Web Browser is prone to a heap-based buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

Successfully exploiting this vulnerability can allow remote attackers to execute arbitrary machine code in the context of the application. Failed attempts will likely result in denial-of-service conditions.

This issue affects Android SDK m3-rc37a and earlier.

Android Web Browser GIF File Heap-Based Buffer Overflow Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/28005.py

Android Web Browser GIF File Heap-Based Buffer Overflow Vulnerability

Solution:
The vendor has addressed this issue in Android SDK m5-rc15. Please see the references for more information.

Android Web Browser GIF File Heap-Based Buffer Overflow Vulnerability

References:

• Android Homepage (Google)
  
• Android SDK update: m5-rc15 released (Google)