PT-2015-2226 · Google · Android

Published 2015-10-01 · Updated 2015-10-01 · CVE-2015-1541

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions prior to 5.1.1 LMY48I

Description The issue is related to the implementation of AppWidgetServiceImpl in the Android operating system, which has inadequate access control. This can be exploited by a remote attacker to bypass existing access restrictions. The vulnerability can be used to obtain a URI permission by sending an Intent with specific flags, such as FLAG GRANT READ URI PERMISSION or FLAG GRANT WRITE URI PERMISSION, potentially allowing the bypassing of intended restrictions on reading contacts.

Recommendations For Android versions prior to 5.1.1 LMY48I, update to version 5.1.1 LMY48I or later to resolve the issue. As a temporary workaround, consider restricting the use of the AppWidgetServiceImpl service to minimize the risk of exploitation. Avoid using the FLAG GRANT READ URI PERMISSION and FLAG GRANT WRITE URI PERMISSION flags in Intents until the issue is resolved.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2015-11572

CVE-2015-1541

Affected Products

Android

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-1541 · Security Note
• https://bdu.fstec.ru/vul/2015-11572 · Security Note
• https://groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/base/+/0b98d304c467184602b4c6bce76fda0b0274bc07 · Vendor Advisory