Open Handset Alliance Android 'data/WorkingMessage.java' Information Disclosure Vulnerability

Bugtraq ID:	46105
Class:	Design Error
CVE:	CVE-2011-0680
Remote:	Yes
Local:	No
Published:	Feb 02 2011 12:00AM
Updated:	Feb 02 2011 12:00AM
Credit:	The vendor
Vulnerable:	Open Handset Alliance Android 2.3.1 Open Handset Alliance Android 2.3 Open Handset Alliance Android 2.2
Not Vulnerable:	Open Handset Alliance Android 2.3.2

Open Handset Alliance Android 'data/WorkingMessage.java' Information Disclosure Vulnerability

Open Handset Alliance Android is prone to an information-disclosure vulnerability.

A remote attacker can exploit this issue to obtain potentially sensitive information. Information obtained may aid in further attacks.

Open Handset Alliance Android 'data/WorkingMessage.java' Information Disclosure Vulnerability

It is unknown at this time if an attacker can directly trigger this issue. The attacker would also likely need to be in communication with the victim prior to the event.

Open Handset Alliance Android 'data/WorkingMessage.java' Information Disclosure Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

Open Handset Alliance Android 'data/WorkingMessage.java' Information Disclosure Vulnerability

References:

• Issue 9392: SMS are intermittently sent to wrong and seemingly random contac (Open Handset Alliance)
  
• Android 2.3.2 Update Pushing to Nexus S Phone, Fixes SMS Bug (Kevin Krause )
  
• Android Homepage (Open Handset Alliance)