PT-2017-6117 · Google · Android

Publicado 2017-07-07 · Atualizado 2018-10-09 · CVE-2014-7953

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Android version 4.4.4

Description: A race condition exists in the bindBackupAgent method within the ActivityManagerService in Android. This issue allows local users with adb shell access to execute arbitrary code or install any valid package as the system user. The exploitation involves running pm install with a target APK while simultaneously executing a crafted script that processes logcat output to find a dexopt line. Once the dexopt line is found, the script executes bindBackupAgent with the uid member of the ApplicationInfo parameter set to 1000.

Recommendations: For Android version 4.4.4, as a temporary workaround, consider restricting access to the bindBackupAgent method until a patch is available. Additionally, restrict the use of adb shell to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2014-7953

Produtos afetados

Android

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-7953 · Nota de Segurança
• http://securityfocus.com/bid/74213 · Nota
• https://android.googlesource.com/platform/frameworks/base/+/a8f6d1b%5E%21 · Nota
• http://seclists.org/fulldisclosure/2015/Apr/52 · Nota
• http://securityfocus.com/archive/1/535296/100/1100/threaded · Nota