PT-2016-1806 · Google · Android

Heisecode + 1 · Published 2016-04-18 · Updated 2016-04-25 · CVE-2016-2419

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions prior to 2016-04-01

Description The issue concerns a component of the Android operating system, specifically the media/libmedia/IDrm.cpp in the mediaserver. It does not properly initialize a certain key-request data structure. This can be exploited by a remote attacker to obtain sensitive information from process memory, thereby bypassing an unspecified protection mechanism. The exploitation can be achieved via unspecified vectors, potentially allowing attackers to gain Signature or SignatureOrSystem access.

Recommendations For Android versions prior to 2016-04-01, update the operating system to a version released after 2016-04-01 to resolve the issue. As a temporary workaround, consider restricting access to sensitive information and limiting the use of the mediaserver to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2016-01139

CVE-2016-2419

Affected Products

Android

References · 8

• http://source.android.com/security/bulletin/2016-04-02.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-2419 · Security Note
• https://bdu.fstec.ru/vul/2016-01139 · Security Note
• https://osv.dev/vulnerability/CVE-2016-2419 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2419 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2419 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2419 · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/av/+/5a856f2092f7086aa0fea9ae06b9255befcdcd34 · Note