Google Android 'BnAudioPolicyService::onTransact()' Function Integer Overflow Vulnerability

Bugtraq ID:	73048
Class:	Boundary Condition Error
CVE:	CVE-2015-1530
Remote:	Yes
Local:	No
Published:	Mar 11 2015 12:00AM
Updated:	Nov 03 2015 07:36PM
Credit:	Guang Gong
Vulnerable:	Google Android 3.1.4 Google Android 2.3.5 Google Android 2.2.3 Google Android 3.2 Google Android 3.0 Google Android 2.3.4 Google Android 2.3.3 Google Android 2.3.2 Google Android 2.3.1 Google Android 2.2.2 Google Android 2.2.1 Google Android 2.2 Google Android 2.1 Google Android 1.6 Google Android 1.5
Not Vulnerable:

Google Android 'BnAudioPolicyService::onTransact()' Function Integer Overflow Vulnerability

Google Android is prone to an integer-overflow vulnerability because it fails to properly bounds check user-supplied input before copying it into an insufficiently sized buffer.

Attackers can exploit this issue to gain elevated privileges or cause a denial-of-service condition.

Google Android 'BnAudioPolicyService::onTransact()' Function Integer Overflow Vulnerability

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

Google Android 'BnAudioPolicyService::onTransact()' Function Integer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Google Android 'BnAudioPolicyService::onTransact()' Function Integer Overflow Vulnerability

References:

• Android Homepage (Google)