Android Settings application CVE-2014-8609 Privilage Escalation Vulnerability

Bugtraq ID:	71314
Class:	Design Error
CVE:	CVE-2014-8609
Remote:	Yes
Local:	No
Published:	Nov 26 2014 12:00AM
Updated:	Nov 26 2014 12:00AM
Credit:	WangTao, WangYu and Zhang Donghui of Baidu X-Team
Vulnerable:	Google Android 3.1.4 Google Android 2.3.5 Google Android 2.2.3 Google Android 3.2 Google Android 3.0 Google Android 2.3.4 Google Android 2.3.3 Google Android 2.3.2 Google Android 2.3.1 Google Android 2.2.2 Google Android 2.2.1 Google Android 2.2 Google Android 2.1 Google Android 1.6 Google Android 1.5
Not Vulnerable:

Android Settings application CVE-2014-8609 Privilage Escalation Vulnerability

Android Settings application is prone to a privilege-escalation vulnerability.

An attacker can leverage this issue to gain escalated privileges and perform unauthorized actions which may aid in launching further attacks.

Android versions prior to 5.0 are vulnerable.

Android Settings application CVE-2014-8609 Privilage Escalation Vulnerability

The researcher who discovered this issue has created a proof-of-concept. This proof-of-concept is not otherwise publicly available or known to be circulating in the wild.

Android Settings application CVE-2014-8609 Privilage Escalation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Android Settings application CVE-2014-8609 Privilage Escalation Vulnerability

References:

• Android Homepage (Google)