PT-2015-2210 · Google · Android

Publicado 2015-10-01 · Atualizado 2015-10-01 · CVE-2015-3845

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Android versions prior to 5.1.1 LMY48M

Description The issue is related to the Parcel::appendFrom function in Android's Binder, which does not properly consider parcel boundaries during the identification of binder objects in an append operation. This allows attackers to obtain different application's privileges via a crafted application. The vulnerability is related to insufficient access control to certain functions, which can be exploited by a remote attacker to gain privileges of various applications using a specially crafted application.

Recommendations For Android versions prior to 5.1.1 LMY48M, update to version 5.1.1 LMY48M or later to resolve the issue. As a temporary workaround, consider restricting access to the Parcel::appendFrom function until a patch is available. Avoid using the Parcel::appendFrom function in applications that require high privileges until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2015-11556

CVE-2015-3845

Produtos afetados

Android

Referências · 7

• https://osv.dev/vulnerability/UBUNTU-CVE-2015-3845 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-3845 · Nota de Segurança
• https://ubuntu.com/security/CVE-2015-3845 · Aviso do Fabricante
• https://android.googlesource.com/platform/frameworks/native/+/e68cbc3e9e66df4231e70efa3e9c41abc12aea20 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-3845 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-11556 · Nota de Segurança
• https://groups.google.com/forum/message/raw?msg=android-security-updates/1M7qbSvACjo/Y7jewiW1AwAJ · Aviso do Fabricante