92 matches found
Android Vulnerability Bypasses App's Digital Signature
A vulnerability exists in the Android code base that would allow a hacker to modify a legitimate, digitally signed Android application package file APK and not break the app’s cryptographic signature—an action that would normally set off a red flag that something is amiss. Researchers at startup...
360手机卫士 for Android 权限许可和访问控制漏洞
CVE-2011-4769 Android是Google通过Open Handset Alliance发起的项目，用于为移动设备提供完整的软件集，包括操作系统、中间件等。 360手机卫士,360 MobileSafe com.qihoo360.mobilesafe应用程序2.1.0版本和2.2.0版本中存在漏洞，该漏洞源于未能正确保护数据。远程攻击者可利用此漏洞借助特制应用程序读取或修改SMS消息。 0 360手机卫士360 MobileSafe 2.1.0 360手机卫士360 MobileSafe 2.2.0 目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接：...
Android浏览器证书伪造漏洞
Open Handset Alliance Android是一款超过30家科技与移动电话公司所组成的团体开发的免费的移动电话平台 由于浏览器显示错误证书信息，可通过iframe可使用其他合法站点的证书，使用户信任当前网页内容 0 Android 3.x 厂商解决方案 目前没有详细解决方案提供： http://www.android.com/...
Researchers Say Carrier IQ Not Logging Texts or Emails, But Has Some Worrisome Capabilities
Security researchers who have investigated the inner workings of the Carrier IQ software and its capabilities say that the application has some powerful, and potentially worrisome capabilities, but that as it’s currently deployed by carriers it doesn’t have the ability to record SMS messages, pho...
Android 'vold'释放后使用本地特权提升漏洞
Bugtraq ID: 50598 CVE ID：CVE-2011-4123 Open Handset Alliance Android是一款超过30家科技与移动电话公司所组成的团体开发的免费的移动电话平台。 在Android平台上"log"组的本地用户向vold "volume daemon"发送畸形消息，可触发基于栈的缓冲区溢出。通过释放任意堆对象触发释放后使用错误，可在所有Froyo 2.2.x和Gingerbread 2.4.x设备上提升特权。不过看起来在Honeycomb 3.x中已经得到修补。 Open Handset Alliance Android 2.3.5 Open...
Android浏览器沙盒安全限制绕过漏洞
CVE ID: CVE-2011-2357 Android是Google通过Open Handset Alliance发起的项目，用于为移动设备提供完整的软件集，包括操作系统、中间件等。 Android浏览器在沙盒验证的实现上存在安全问题，远程攻击者可利用此漏洞绕过沙盒并在任意域注入并执行脚本代码。 此漏洞源于Android浏览器在加载URL时存在的错误。成功利用需要安装并使用恶意应用程序。 Android Open Handset Alliance Android 3.x 厂商补丁： Android ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
Open Handset Alliance Android 2.3.43.1 - Browser Sandbox Security Bypass
Open Handset Alliance Android 2.3.43.1 - Browser Sandbox Security Bypass source: https://www.securityfocus.com/bid/48954/info Open Handset Alliance Android is prone to a vulnerability that may allow a bypass of the browser sandbox. Successful exploits will allow attackers to execute arbitrary...
Open Handset Alliance Android 2.3.4/3.1 - Browser Sandbox Security Bypass
source: https://www.securityfocus.com/bid/48954/info Open Handset Alliance Android is prone to a vulnerability that may allow a bypass of the browser sandbox. Successful exploits will allow attackers to execute arbitrary script code within the context of an arbitrary domain. Android 2.3.4 and 3.1...
Researcher Publishes Android Browser Exploit
UPDATE: A researcher at security firm Alert Logic has published code that could be used to compromise some versions of Google’s Android Operating System. The exploit, if properly adapted, could make Android phones vulnerable to remote attacks and compromises. Researcher MJ Keith published a Rever...
Researcher to Show Off GSM Intercept Attack at Defcon
At the Defcon conference later this week, Chris Paget, a well-known security researcher who focuses on wireless and RFID issues, will give a demonstration of a technique that enables him to intercept calls made on GSM wireless handsets without any interaction with the user’s handset. The techniqu...
Vodafone-Distributed Handset Found Pre-installed With Mariposa Bot
Security researchers have found the Mariposa bot client pre-installed on a mobile phone handset distributed in Europe, and say that the malware looks to have been installed on the phone’s memory card. The phone, the HTC Magic, runs the Google Android mobile operating system, and is a low-priced...
HTC Touch 3G Windows Mobile/Open Handset Alliance Android SMS远程拒绝服务漏洞
HTC Touch 3G Windows Mobile是一款使用Windows Mobile操作系统的智能手机。Open Handset Alliance Android是一款超过30家科技与移动电话公司所组成的团体开发的免费的移动电话平台。 HTC Touch 3G Windows Mobile/Open Handset Alliance Android不正确处理特殊构建的SMS消息，远程攻击者可以利用漏洞关闭设备的用户接口，使设备从网络中断开，导致拒绝服务攻击。 Microsoft Windows Mobile Professional 6.1 Microsoft Windows...
Open Handset Alliance Android签名验证本地特权提升漏洞
Bugraq ID: 35090 CVE ID：CVE-2009-1754 CNCVE ID：CNCVE-20091754 Open Handset Alliance Android是一款超过30家科技与移动电话公司所组成的团体开发的免费的移动电话平台。 当安装包请求共享用户IDUID权限时Android不正确检查开发者证书，本地攻击者可以利用漏洞提升特权。 一般情况下，如果安装包签署了相同的开发者证书并在安装时间请求权限，Android应用程序允许共享一个UID，这允许来自相同作者的安装包共享数据。存在漏洞允许任意以此行为安装的应用程序获得对其他已存在应用程序数据的访问。 Open...
Integer overflow
Integer overflow in the showLog function in fakelogdevice.c in liblog in Open Handset Alliance Android 1.0 allows attackers to trigger a buffer overflow and possibly have unspecified other impact by sending a large number of input lines...
Integer overflow
Multiple integer overflows in mallocleak.c in Bionic in Open Handset Alliance Android 1.0 have unknown impact and attack vectors, related to the 1 chkcalloc and 2 leakcalloc functions...
CVE-2009-0606
The CVE-2009-0606 entry concerns Android 1.0 (Open Handset Alliance) on the T-Mobile G1, where the link_image function in linker/linker.c of Bionic’s dynamic linker mishandles file descriptors 0, 1, and 2 for a setgid program. This behavior could allow local users to create arbitrary files owned ...
CVE-2009-0608
CVE-2009-0608 describes an integer overflow in the showLog function of fake_log_device.c within liblog on Android 1.0. Sending a large number of input lines can trigger a buffer overflow with unspecified additional impact. Affected component: Open Handset Alliance Android liblog (fake_log_device....
CVE-2009-0607
CVE-2009-0607 describes multiple integer overflows in the malloc_leak.c code of Bionic on Android 1.0, related to the functions (1) chk_calloc and (2) leak_calloc. The vulnerability affects the Open Handset Alliance Android 1.0 stack, but explicit impact and attack vectors are not provided in the...
SonyEricsson WAP Push Denial of Service
Security Advisory MSL-2008-001 - SonyEricsson WAP Push Denial of Service Advisory Information -------------------- Title: SonyEricsson WAP Push Denial of Service Advisory ID: MSL-2008-001 Advisory URL: http://www.mseclab.com/index.php?pageid=123 Published: 2009-01-26 Updated: 2009-01-26 Vendor:...
Android WEB浏览器未明远程代码执行漏洞
BUGTRAQ ID: 31946 CNCAN ID：CNCAN-2008102901 Android是一款Google通过Open Handset Alliance发起的项目，用于为移动设备提供完整的软件集，包括操作系统、中间件等。 Android Web浏览器存在一个未明安全问题，远程攻击者可以利用漏洞以浏览器内容上下文执行任意代码。 攻击者必须构建恶意链接，诱使用户访问来触发。 HTC T-Mobile G1 Google Android 目前没有解决方案提供： http://code.google.com/android/...