openSUSE Security Update : android-tools (openSUSE-SU-2014:0637-1)

Fix overflow in adb CVE-2014-1909 bnc863074 - fix-overflow-in-adbclient.patch %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2014-358. The text description of this plugin is C SUSE...

openSUSE Security Update : android-tools (openSUSE-SU-2014:0636-1)

Fix overflow in adb CVE-2014-1909 bnc863074 - fix-overflow-in-adbclient.patch %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2014-357. The text description of this plugin is C SUSE...

vold asec

Insufficient paramter checking for asec container creation allows an asec container to be mounted over part of the filesystem using directory traversal if the app has the ASEC permissions such as ASECCREATE There is an adb tethered root explot for motorola phones...

Faceless: Account hijacking possible through ADB backup feature

It was found that if an attacker had access to an unlocked phone, they could take any data from the application's sandbox through ADB's backup feature. Normally ADB backup allows applications to be backed up to the cloud. This means that if a user replaces or wipes their phone, they can restore a...

Integer overflow

Integer signedness error in system/core/adb/adbclient.c in Android Debug Bridge ADB for Android 4.4 in the Android SDK Platform Tools 18.0.1 allows ADB servers to execute arbitrary code via a negative length value, which bypasses a signed comparison and triggers a stack-based buffer overflow...

PT-2014-4359

Name of the Vulnerable Software and Affected Versions Android SDK Platform Tools version 18.0.1 Description The issue is caused by an integer signedness error in the system/core/adb/adb client.c file of the Android Debug Bridge ADB for Android 4.4. This error allows ADB servers to execute arbitra...

CVE-2014-1909

CVE-2014-1909 is an integer signedness error in Android’s ADB implementation (system/core/adb/adb_client.c) affecting Android 4.4 with Platform Tools 18.0.1. Exploitation could allow an ADB server to execute arbitrary code via a negative length value that defeats a signed check and triggers a sta...

CVE-2013-6770

The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.3 and 4.4 does not properly restrict the set of users who can execute /system/xbin/su with the --daemon option, which allows attackers to gain privileges by leveraging ADB shell access and a certain Linux UID, and then...

CVE-2013-6770

The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.3 and 4.4 does not properly restrict the set of users who can execute /system/xbin/su with the --daemon option, which allows attackers to gain privileges by leveraging ADB shell access and a certain Linux UID, and then...

PT-2014-3197

Name of the Vulnerable Software and Affected Versions CyanogenMod/ClockWorkMod/Koush Superuser package version 1.0.2.1 Description The issue concerns the CyanogenMod/ClockWorkMod/Koush Superuser package, which does not properly restrict the set of users who can execute /system/xbin/su with the...

CVE-2013-6770: Undefined Security Weakness

The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.3 and 4.4 does not properly restrict the set of users who can execute /system/xbin/su with the --daemon option, which allows attackers to gain privileges by leveraging ADB shell access and a certain Linux UID, and then...

Windows Spy tool equipped with Android malware to hack Smartphones

I am quite sure that you must be syncing your Smartphone with your Computers for transferring files and taking backup of your device. If you are using windows operating system and Android devices, then it’s a bad news for you, because FireEye Security Researchers have identified a new piece of...

[CVE-2013-5112] Evernote Android Insecure Storage of PIN data / Bypass of PIN protection

Evernote Android Insecure Storage of PIN data / Bypass of PIN protection Product: Evernote Android Project Homepage: evernote.com Internal Advisory ID: c22-2013-03 / c22-2013-04 Vulnerable Versions: Android version 5.5.0 and prior Tested Version: Android 5.x Android 4.2/4.3 Vendor Notification: A...

[CVE-2013-5116] Evernote Android Insecure Password Change (one-click setup)

Evernote Android Insecure Password Change one-click setup Product: Evernote Android Project Homepage: evernote.com Internal Advisory ID: c22-2013-05 Vulnerable Versions: Android version 5.5.0 and prior Tested Version: Android 5.x Android 4.2/4.3 Vendor Notification: Aug 13, 2013 Public Disclosure...

Android 4.3 Superuser Root Privilege Escalation Vulnerability

The Superuser package for Android 4.3 allows a user to spawn /system/xbin/su with manipulated environment variables to execute code as root. Current releases of the CyanogenMod/ClockWorkMod/Koush Superuser package may allow restricted local users to execute arbitrary commands as root in certain,...

Android 4.3 Superuser Root Privilege Escalation

Current releases of the CyanogenMod/ClockWorkMod/Koush Superuser package may allow restricted local users to execute arbitrary commands as root in certain, non-default device configurations. Android 4.3 introduced the concept of "restricted profiles," created through the Settings - Users menu. A...

RageAgainstTheCage adb

adb fails to check setuid return code and this can be caused to fail by the shell user already having RLIMITNPROC processes...

Android ICS adb debugging tools System Restore directory traversal vulnerability, can provide right-vulnerability warning-the black bar safety net

原 漏洞 信息 来自 于 [email protected] Vulnerability description: adb Android Debug Bridge backup/restore option allows you to backup and restore applications, including system applications. Backup files to tar. the zlib PACKAGE, files the default suffix is . ab. When a backup contains a file, the file...

Android Debug Bridge Traversal

Hi, adb Android Debug Bridge backup/restore allows you to backup and restore applications via adb, including system applications. The backed up files are stored in tar.zlib named .ab by default files. "adb restore" is vulnerable to a directory traversal attack. By creating a file named...

PT-2013-4556

Name of the Vulnerable Software and Affected Versions LG Optimus G E973 Description The issue allows physically proximate attackers to execute arbitrary commands. This can be achieved by entering USB Debugging mode, using Android Debug Bridge adb to establish a USB connection, dialing 3845973,...