PT-2014-4374 · Google · Android

Publicado 2014-03-03 · Atualizado 2016-05-26 · CVE-2014-1939

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Android versions prior to 4.4

Description The issue allows attackers to execute arbitrary Java code by leveraging access to the searchBoxJavaBridge interface at certain Android API levels. This is due to the use of the addJavascriptInterface API in conjunction with creating an object of the SearchBoxImpl class in java/android/webkit/BrowserFrame.java.

Recommendations For Android versions prior to 4.4, as a temporary workaround, consider restricting access to the searchBoxJavaBridge interface until a patch is available.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2014-1939

Produtos afetados

Android

Referências · 4

• http://blog.chromium.org/2013/11/introducing-chromium-powered-android.html · Nota
• https://support.lenovo.com/us/en/product_security/len_6421 · Nota
• http://openwall.com/lists/oss-security/2014/02/11/2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-1939 · Nota de Segurança