Open Handset Alliance Android IPC Default Policy Local Privilege Escalation Vulnerability

Bugtraq ID:	47892
Class:	Unknown
CVE:
Remote:	No
Local:	Yes
Published:	May 17 2011 12:00AM
Updated:	May 17 2011 12:00AM
Credit:	Privateer Labs
Vulnerable:	Open Handset Alliance Android 2.3.2 Open Handset Alliance Android 2.3.1 Open Handset Alliance Android 2.0.1 Open Handset Alliance Android 2.3 Open Handset Alliance Android 2.2 Open Handset Alliance Android 2.1.1 Open Handset Alliance Android 2.1 Open Handset Alliance Android 2.0 Open Handset Alliance Android 1.5 CRCxx Open Handset Alliance Android 1.5 CRBxx Open Handset Alliance Android 1.5 CRB-43 Open Handset Alliance Android 1.5 CRB-42 Open Handset Alliance Android 1.5 COCxx Open Handset Alliance Android 1.5 CBDxx Open Handset Alliance Android 1.5 Open Handset Alliance Android 1.0 Open Handset Alliance Android 0
Not Vulnerable:

Open Handset Alliance Android IPC Default Policy Local Privilege Escalation Vulnerability

Open Handset Alliance Android is prone to a privilege-escalation vulnerability.

Successfully exploiting this issue can allow attackers to bypass sandbox protections and perform actions with elevated privileges on less privileged applications.

Open Handset Alliance Android IPC Default Policy Local Privilege Escalation Vulnerability

Exploit code is available. Please see the references for more information.

Open Handset Alliance Android IPC Default Policy Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Open Handset Alliance Android IPC Default Policy Local Privilege Escalation Vulnerability

References:

• Android Homepage (Open Handset Alliance)
  
• Skype Call Escalation of Privilege (Privateer Labs)