Google Android 'handleSmsSent()' Function Information Disclosure Vulnerability

Bugtraq ID:	71316
Class:	Configuration Error
CVE:	CVE-2014-8610
Remote:	Yes
Local:	No
Published:	Nov 26 2014 12:00AM
Updated:	Nov 26 2014 12:00AM
Credit:	WangTao (neobyte), WangYu and Zhang Donghui of Baidu X-Team.
Vulnerable:	Google Android 3.1.4 Google Android 2.3.5 Google Android 2.2.3 Google Android 3.2 Google Android 3.0 Google Android 2.3.4 Google Android 2.3.3 Google Android 2.3.2 Google Android 2.3.1 Google Android 2.3 Rev1 Google Android 2.2.2 Google Android 2.2.1 Google Android 2.2 Rev1 Google Android 2.2 Google Android 2.1 Google Android 1.6 Google Android 1.5
Not Vulnerable:

Google Android 'handleSmsSent()' Function Information Disclosure Vulnerability

Google Android is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to obtain potentially sensitive information. Information obtained may aid in further attacks.

Versions prior to Google Android 5.0 are vulnerable.

Google Android 'handleSmsSent()' Function Information Disclosure Vulnerability

Attackers can use a malicious application to exploit this issue.

The researchers who discovered this issue have created a proof-of-concept. Please see the references for more information.

Google Android 'handleSmsSent()' Function Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Google Android 'handleSmsSent()' Function Information Disclosure Vulnerability

References:

• Android Homepage (Google)
  
• Bug 17671795 - Externally Reported Low Severity Security Vulnerability: SMS Rese (Tom Taylor)
  
• CVE-2014-8610 Android < 5.0 SMS resend vulnerability (Wang,Tao(Scloud))