Open Handset Alliance Android Signature Validation Local Privilege Escalation Vulnerability

Bugtraq ID:	35090
Class:	Input Validation Error
CVE:	CVE-2009-1754
Remote:	No
Local:	Yes
Published:	May 25 2009 12:00AM
Updated:	May 25 2009 07:10PM
Credit:	Panasonic
Vulnerable:	Open Handset Alliance Android 1.5 CRB-42
Not Vulnerable:	Open Handset Alliance Android 1.5 CRB-43

Open Handset Alliance Android Signature Validation Local Privilege Escalation Vulnerability

Open Handset Alliance Android is prone to a local privilege-escalation vulnerability because it fails to sufficiently validate user-supplied data.

An attacker can exploit this issue to execute arbitrary commands with elevated privileges. Successful exploits may completely compromise affected devices.

Android 1.5 CRB17 through 1.5 CRB42 are vulnerable.

Open Handset Alliance Android Signature Validation Local Privilege Escalation Vulnerability

To exploit this issue, attackers need local access and can use readily available tools.

Open Handset Alliance Android Signature Validation Local Privilege Escalation Vulnerability

Solution:
The vendor has released updates. Please see the references for details.

Open Handset Alliance Android Signature Validation Local Privilege Escalation Vulnerability

References:

• #2009-006 Android improper package verification when using shared uids (oCERT)
  
• AI 148824: Fix issue #1851541 (sharedUserId requests not being checked for match (Dianne Hackborn)
  
• Android Homepage (Open Handset Alliance)
  
• [oCERT-2009-006] Android improper package verification when using shared uids (Will Drewry )