PT-2015-3523 · Google · Android

Publicado 2015-04-01 · Atualizado 2024-06-15 · CVE-2012-2808

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions prior to 4.1.1

Description The issue concerns the PRNG implementation in the DNS resolver in Bionic, which incorrectly utilizes time and PID information to generate random numbers for query ID values and UDP source ports. This makes it easier for remote attackers to spoof DNS responses by guessing these numbers.

Recommendations For Android versions prior to 4.1.1, update to version 4.1.1 or later to resolve the issue.

Exploit

Correção

Identificadores relacionados

CVE-2012-2808

OPENSUSE-SU-2024:10071-1

Produtos afetados

Android

Referências · 903

• 🔥 http://blog.watchfire.com/files/androiddnsweakprng.pdf · Exploit
• https://suse.com/security/cve/CVE-2015-7191 · Nota
• https://suse.com/security/cve/CVE-2015-7208 · Nota
• https://suse.com/security/cve/CVE-2012-4217 · Nota
• https://suse.com/security/cve/CVE-2014-1494 · Nota
• https://suse.com/security/cve/CVE-2015-7179 · Nota
• https://suse.com/security/cve/CVE-2012-0473 · Nota
• https://suse.com/security/cve/CVE-2012-1937 · Nota
• https://suse.com/security/cve/CVE-2014-8643 · Nota
• https://suse.com/security/cve/CVE-2010-0165 · Nota
• https://suse.com/security/cve/CVE-2012-3963 · Nota
• https://suse.com/security/cve/CVE-2009-1307 · Nota
• https://suse.com/security/cve/CVE-2012-3982 · Nota
• https://suse.com/security/cve/CVE-2014-1548 · Nota
• https://suse.com/security/cve/CVE-2012-3961 · Nota