Open Handset Alliance Android Permission Verification Multiple Security Bypass Vulnerabilities
BID:35717
Info
Open Handset Alliance Android Permission Verification Multiple Security Bypass Vulnerabilities
| Bugtraq ID: | 35717 |
| Class: | Access Validation Error |
| CVE: |
CVE-2009-2348 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 16 2009 12:00AM |
| Updated: | Jul 17 2009 08:46PM |
| Credit: | Chris Palmer, iSEC Partners |
| Vulnerable: |
Open Handset Alliance Android 1.5 CRBxx Open Handset Alliance Android 1.5 CRB-43 Open Handset Alliance Android 1.5 CRB-42 Open Handset Alliance Android 0 |
| Not Vulnerable: |
Open Handset Alliance Android 1.5 CRCxx Open Handset Alliance Android 1.5 COCxx Open Handset Alliance Android 1.5 CBDxx |
Discussion
Open Handset Alliance Android Permission Verification Multiple Security Bypass Vulnerabilities
Android from Open Handset Alliance is prone to multiple security-bypass vulnerabilities because applications can bypass permission checks when they access certain resources.
Successful exploits can allow an attacker to perform unauthorized actions on the affected device; other attacks are also possible.
These issues affect all Android 1.5 CRBxx versions. These issues have been resolved in all Android 1.5 CBDxx, 1.5 CRCxx, and 1.5 COCxx versions.
Android from Open Handset Alliance is prone to multiple security-bypass vulnerabilities because applications can bypass permission checks when they access certain resources.
Successful exploits can allow an attacker to perform unauthorized actions on the affected device; other attacks are also possible.
These issues affect all Android 1.5 CRBxx versions. These issues have been resolved in all Android 1.5 CBDxx, 1.5 CRCxx, and 1.5 COCxx versions.
Exploit / POC
Open Handset Alliance Android Permission Verification Multiple Security Bypass Vulnerabilities
Attackers can exploit these issues by enticing an unsuspecting victim into installing a malicious application on an Android-based device.
Attackers can exploit these issues by enticing an unsuspecting victim into installing a malicious application on an Android-based device.
Solution / Fix
Open Handset Alliance Android Permission Verification Multiple Security Bypass Vulnerabilities
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.
References
Open Handset Alliance Android Permission Verification Multiple Security Bypass Vulnerabilities
References:
References:
- #2009-011 Android improper camera and audio permission verification (oCERT Advisories)
- AI 149133: Enable the camera permission check. (Dave Sparks)
- AI 149135: Add RECORD_AUDIO permission to camera app. (Dave Sparks)
- AI 149136: Restore RECORD_AUDIO permission check to MediaRecorder. (Dave Sparks)
- Android Homepage (Open Handset Alliance)
- [oCERT-2009-011] Android improper camera and audio permission verification (Andrea Barisani