Open Handset Alliance Android Lock Screen Security Bypass Vulnerability

Bugtraq ID:	46553
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Feb 24 2011 12:00AM
Updated:	Feb 24 2011 12:00AM
Credit:	Tim Brown
Vulnerable:	Open Handset Alliance Android 2.3.2 Open Handset Alliance Android 2.3.1 Open Handset Alliance Android 2.0.1 Open Handset Alliance Android 2.3 Open Handset Alliance Android 2.2 Open Handset Alliance Android 2.1 Open Handset Alliance Android 1.5 CRCxx Open Handset Alliance Android 1.5 CRBxx Open Handset Alliance Android 1.5 CRB-43 Open Handset Alliance Android 1.5 CRB-42 Open Handset Alliance Android 1.5 COCxx Open Handset Alliance Android 1.5 CBDxx Open Handset Alliance Android 1.5 Open Handset Alliance Android 1.0 Open Handset Alliance Android 0
Not Vulnerable:

Open Handset Alliance Android Lock Screen Security Bypass Vulnerability

Open Handset Alliance Android is prone to a security-bypass vulnerability due to a failure to restrict access to locked devices.

An attacker with physical access to a locked device can exploit this issue to bypass the passcode. Successful exploits may lead to other attacks.

Open Handset Alliance Android Lock Screen Security Bypass Vulnerability

An attacker can exploit this issue using readily available tools.

Open Handset Alliance Android Lock Screen Security Bypass Vulnerability

Solution:
The vendor released an update. Please see the references for details.

Open Handset Alliance Android Lock Screen Security Bypass Vulnerability

References:

• Android Homepage (Open Handset Alliance)
  
• Bypassing the Android pattern lock (Tim brown)