PT-2009-4778 · Google · Android

Chris Palmer · Published 2009-07-17 · Updated 2018-10-10 · CVE-2009-2348

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android version 1.5

Description The issue allows local users to bypass certain configuration settings, specifically Manifest.permission.CAMERA and Manifest.permission.AUDIO RECORD, by installing and executing an application that does not request permission before using the camera or microphone.

Recommendations For Android version 1.5, consider restricting access to the camera and microphone until a fix is available, or avoid installing applications that do not properly request permissions for these features.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-2348

Affected Products

Android

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2009-2348 · Security Note
• http://android.git.kernel.org/?p=platform/frameworks/base.git%3Ba=commit%3Bh=7b7225c8fdbead25235c74811b30ff4ee690dc58 · Note
• http://securityfocus.com/archive/1/505012/100/0/threaded · Note
• http://android.git.kernel.org/?p=platform/packages/apps/Camera.git%3Ba=commit%3Bh=e655d54160e5a56d4909f2459eeae9012e9f187f · Note
• http://securityfocus.com/bid/35717 · Note
• http://openwall.com/lists/oss-security/2009/07/16/4 · Note
• http://ocert.org/advisories/ocert-2009-011.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51798 · Note
• http://android.git.kernel.org/?p=platform/frameworks/base.git%3Ba=commit%3Bh=4d8adefd35efdea849611b8b02d61f9517e47760 · Note