Android Web Browser Unspecified Remote Code Execution Vulnerability
BID:31946
Info
Android Web Browser Unspecified Remote Code Execution Vulnerability
| Bugtraq ID: | 31946 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 24 2008 12:00AM |
| Updated: | Oct 28 2008 06:36PM |
| Credit: | Charlie Miller, Mark Daniel, and Jake Honoroff |
| Vulnerable: |
HTC T-Mobile G1 0 Google Android 0 |
| Not Vulnerable: | |
Discussion
Android Web Browser Unspecified Remote Code Execution Vulnerability
Android Web Browser is prone to an unspecified remote code-execution vulnerability.
Successful exploits allow attackers to execute arbitrary code in the context of the browser. Note that attackers can exploit this issue to compromise only the browser, which may result in information-disclosure attacks.
Reportedly, this issue stems from an older vulnerability in one of the third-party packages used by Android. No further details are currently available. We will update or retire this BID when more information emerges.
NOTE: The HTC T-Mobile G1 phone ships with a vulnerable version of Android and is also affected by this issue.
Android Web Browser is prone to an unspecified remote code-execution vulnerability.
Successful exploits allow attackers to execute arbitrary code in the context of the browser. Note that attackers can exploit this issue to compromise only the browser, which may result in information-disclosure attacks.
Reportedly, this issue stems from an older vulnerability in one of the third-party packages used by Android. No further details are currently available. We will update or retire this BID when more information emerges.
NOTE: The HTC T-Mobile G1 phone ships with a vulnerable version of Android and is also affected by this issue.
Exploit / POC
Android Web Browser Unspecified Remote Code Execution Vulnerability
The researchers who reported this issue have developed a working exploit. This exploit is not publicly available or known to be circulating in the wild.
The researchers who reported this issue have developed a working exploit. This exploit is not publicly available or known to be circulating in the wild.
Solution / Fix
Android Web Browser Unspecified Remote Code Execution Vulnerability
Solution:
Reportedly the issue has been fixed in the open-source version of the application. Symantec was unable to confirm this information.
Solution:
Reportedly the issue has been fixed in the open-source version of the application. Symantec was unable to confirm this information.
References
Android Web Browser Unspecified Remote Code Execution Vulnerability
References:
References:
- Android Homepage (Google)
- Security Flaw Is Revealed in T-Mobile's Google Phone (New York Times)
- Exploiting Android (Independent Security Evaluators)