Vulnerabilities / Threats
2/13/2009
02:07 PM
50%
50%

Android Security Vulnerability Exposed

The bug lies in the media server of the browser, and it could potentially enable hackers to gain control of the audio and video function of an Android handset like the T-Mobile/HTC G1.

Security researcher Charlie Miller has exposed a security vulnerability in Google's open source Android platform that could enable hackers to take control of a user's multimedia functions.

At the SchmooCon hacker conference, Miller said the bug exists in the multimedia subsystem Android uses for its "Chrome Lite" browser, which was provided by PacketVideo's OpenCore media library. The exploit is an integer underflow that can cause improper bounds checking when writing to a heap allocated buffer, Miller said.

Miller originally said the exploit could allow malicious programmers to take control of a user's browser, and he even advised G1 users to avoid using the browser entirely until a patch was released. He later backed off those claims.

Google said it was notified of the flaw prior to the public disclosure, and Android was patched two days later in the source code repository. Google said the patch will be pushed to T-Mobile G1 users at T-Mobile's discretion, and it was not included in the recent RC33 firmware upgrade.

"Media libraries are extremely complex and can lead to bugs, so we designed our media server, which uses OpenCore, to work within its own application sandbox so that security issues in the media server would not affect other applications on the phone such as e-mail, the browser, SMS, and the dialer," said Rich Cannings, Android security engineer, in a statement. "If the bug Charlie reported to us on January 21st is exploited, it would be limited to the media server and could only exploit actions the media server performs, such as listen to and alter some audio and visual media."

This is the second Android bug involving the browser that has been exposed, which could raise some concerns about security. Google said it has designed the OS from the ground up with security in mind, and the sandbox architecture was chosen to limit the damage any exploit could cause.

How can IT departments get a handle on locking down data when it's on the move? InformationWeek has published an independent analysis of this topic. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0714
Published: 2015-05-02
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse Server 10.0(1), 10.5(1), 10.6(1), and 11.0(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCut53595.

CVE-2014-3598
Published: 2015-05-01
The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image.

CVE-2014-8361
Published: 2015-05-01
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request.

CVE-2015-0237
Published: 2015-05-01
Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 ignores the permission to deny snapshot creation during live storage migration between domains, which allows remote authenticated users to cause a denial of service (prevent host start) by creating a long snapshot chain.

CVE-2015-0257
Published: 2015-05-01
Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 uses weak permissions on the directories shared by the ovirt-engine-dwhd service and a plugin during service startup, which allows local users to obtain sensitive information by reading files in the directory.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.