PT-2015-2210 · Google · Android

Published 2015-10-01 · Updated 2015-10-01 · CVE-2015-3845

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Android versions prior to 5.1.1 LMY48M

Description The issue is related to the Parcel::appendFrom function in Android's Binder, which does not properly consider parcel boundaries during the identification of binder objects in an append operation. This allows attackers to obtain different application's privileges via a crafted application. The vulnerability is related to insufficient access control to certain functions, which can be exploited by a remote attacker to gain privileges of various applications using a specially crafted application.

Recommendations For Android versions prior to 5.1.1 LMY48M, update to version 5.1.1 LMY48M or later to resolve the issue. As a temporary workaround, consider restricting access to the Parcel::appendFrom function until a patch is available. Avoid using the Parcel::appendFrom function in applications that require high privileges until the issue is resolved.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-11556

CVE-2015-3845

Affected Products

Android

References · 7

• https://osv.dev/vulnerability/UBUNTU-CVE-2015-3845 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-3845 · Security Note
• https://ubuntu.com/security/CVE-2015-3845 · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/native/+/e68cbc3e9e66df4231e70efa3e9c41abc12aea20 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-3845 · Security Note
• https://bdu.fstec.ru/vul/2015-11556 · Security Note
• https://groups.google.com/forum/message/raw?msg=android-security-updates/1M7qbSvACjo/Y7jewiW1AwAJ · Vendor Advisory