SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Device (VoIP/Phone/FAX)  >   Google Android Vendors:   Google
Google Android Multiple Flaws Let Remote Users Deny Service and Execute Arbitrary Code and Let Applications Obtain Potentially Sensitive Information and Gain Elevated Privileges
SecurityTracker Alert ID:  1036763
SecurityTracker URL:  http://securitytracker.com/id/1036763
CVE Reference:   CVE-2014-4655, CVE-2014-9529, CVE-2015-1465, CVE-2016-1583, CVE-2016-2053, CVE-2016-2446, CVE-2016-2469, CVE-2016-3134, CVE-2016-3858, CVE-2016-3859, CVE-2016-3861, CVE-2016-3862, CVE-2016-3863, CVE-2016-3864, CVE-2016-3865, CVE-2016-3866, CVE-2016-3867, CVE-2016-3868, CVE-2016-3869, CVE-2016-3870, CVE-2016-3871, CVE-2016-3872, CVE-2016-3873, CVE-2016-3874, CVE-2016-3875, CVE-2016-3876, CVE-2016-3877, CVE-2016-3878, CVE-2016-3879, CVE-2016-3880, CVE-2016-3881, CVE-2016-3883, CVE-2016-3884, CVE-2016-3885, CVE-2016-3886, CVE-2016-3887, CVE-2016-3888, CVE-2016-3889, CVE-2016-3890, CVE-2016-3892, CVE-2016-3893, CVE-2016-3894, CVE-2016-3895, CVE-2016-3896, CVE-2016-3897, CVE-2016-3898, CVE-2016-3899, CVE-2016-3951, CVE-2016-4470, CVE-2016-4805, CVE-2016-5340   (Links to External Site)
Date:  Sep 12 2016
Impact:   Denial of service via local system, Denial of service via network, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, User access via local system, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   Multiple vulnerabilities were reported in Google Android. A remote user can cause arbitrary code to be executed on the target system. A remote user or an application can cause denial of service conditions on the target system. An application can obtain potentially sensitive information. An application user can obtain elevated privileges on the target system.

A remote user can create a specially crafted file that, when loaded by the target user, will execute arbitrary code on the target system.

The LibUtils [CVE-2016-3861], Mediaserver [CVE-2016-3862], and MediaMuxer [CVE-2016-3863] components are affected.

An application can gain elevated privileges on the target system.

The Mediaserver [CVE-2016-3870, CVE-2016-3871, CVE-2016-3872], device boot [CVE-2016-3875], Settings [CVE-2016-3876, CVE-2016-3887, CVE-2016-3889], Telephony [CVE-2016-3883], Notification Manager Service [CVE-2016-3884], Debuggerd [CVE-2016-3885], System UI Tuner [CVE-2016-3886], SMS [CVE-2016-3888], and Java Debug Wire Protocol [CVE-2016-3890], kernel security subsystem [CVE-2014-9529, CVE-2016-4470], kernel netfilter subsystem [CVE-2016-3134], kernel USB driver [CVE-2016-3951], kernel sound subsystem [CVE-2014-4655], kernel ASN.1 decoder [CVE-2016-2053], Qualcomm radio interface layer [CVE-2016-3864], Qualcomm subsystem driver [CVE-2016-3858], kernel networking driver [CVE-2016-4805], Synaptics touchscreen driver [CVE-2016-3865], Qualcomm camera driver [CVE-2016-3859], Qualcomm sound driver [CVE-2016-3866], Qualcomm IPA driver [CVE-2016-3867], Qualcomm power driver [CVE-2016-3868], Broadcom Wi-Fi driver [CVE-2016-3869], kernel eCryptfs filesystem [CVE-2016-1583], NVIDIA kernel [CVE-2016-3873], Qualcomm Wi-Fi driver [CVE-2016-3874], and kernel shared memory subsystem [CVE-2016-5340] components are affected.

An application can obtain potentially sensitive information.

The Mediaserver [CVE-2016-3895], AOSP Mail [CVE-2016-3896], Wi-Fi [CVE-2016-3897], Qualcomm SPMI driver [CVE-2016-3892], Qualcomm sound codec [CVE-2016-3893], Qualcomm DMA component [CVE-2016-3894], and other Qualcomm component [CVE-2016-2469] components are affected.

An application can cause denial of service conditions on the target system.

The Telephony [CVE-2016-3898], Mediaserver [CVE-2016-3899, CVE-2016-3878, CVE-2016-3879, CVE-2016-3880, CVE-2016-3881], and kernel networking subsystem [CVE-2015-1465] components are affected.

The following researchers reported these vulnerabilities:

Cory Pruce of Carnegie Mellon University, Gengjia Chen (@chengjia4574) and pjf of IceSword Lab, Qihoo 360 Technology Co. Ltd., Hao Qin of Security Research Lab, Cheetah Mobile, Jann Horn of Google Project Zero, Jianqiang Zhao (@jianqiangzhao) of IceSword Lab, Qihoo 360, Liran Barsisa of Sync.Me, Madhu Priya Murugan of CISPA, Saarland University, Makoto Onuki of Google, Mark Brand of Google Project Zero, Max Spector of Android Security, Quan To of Android Security, Mingjian Zhou (@Mingjian_Zhou), Chiachih Wu (@chiachih_wu), and Xuxian Jiang of C0RE Team, Nathan Crandall (@natecray) of Tesla Motors Product Security Team, Oleksiy Vyalov of Google, Oliver Chang of Google Chrome Security Team, Peng Xiao, Chengming Yang, Ning You, Chao Yang, and Yang song of Alibaba Mobile Security Group, Ronald L. Loor Vargas (@loor_rlv) of TEAM Lv51, IBM Security X-Force Researcher Sagi Kedmi, Scott Bauer (@ScottyBauer1), Seven Shen (@lingtongshen) of TrendMicro, Tim Strazzere (@timstrazz) of SentinelOne / RedNaga, trotmaster (@trotmaster99), Victor Chang of Google, Vignesh Venkatasubramanian of Google, Weichao Sun (@sunblate) of Alibaba Inc, Wenke Dou, Mingjian Zhou (@Mingjian_Zhou), Chiachih Wu (@chiachih_wu), and Xuxian Jiang of C0RE Team, Wish Wu (@wish_wu) of Trend Micro Inc., Xingyu He (@Spid3r_) of Alibaba Inc, Yacong Gu of TCA Lab, Institute of Software, Chinese Academy of Sciences, and Yuru Shao of University of Michigan Ann Arbor.

Impact:   A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.

A remote user or an application can cause denial of service conditions on the target system.

An application can obtain potentially sensitive information on the target system.

An application can obtain elevated privileges on the target system.

Solution:   The vendor has issued a fix (Security patch levels 2016-09-01, 2016-09-05, and 2016-09-06).

The vendor advisory is available at:

https://source.android.com/security/bulletin/2016-09-01.html

Vendor URL:  source.android.com/security/bulletin/2016-09-01.html (Links to External Site)
Cause:   Access control error, Boundary error, Input validation error, State error

Message History:   This archive entry has one or more follow-up message(s) listed below.
Oct 5 2016 (Red Hat Issues Fix for Linux Kernel) Google Android Multiple Flaws Let Remote Users Deny Service and Execute Arbitrary Code and Let Applications Obtain Potentially Sensitive Information and Gain Elevated Privileges
Red Hat has issued a fix for the Linux Kernel for Red Hat Enterprise Linux 6.
Oct 6 2016 (CentOS Issues Fix for Linux) Google Android Multiple Flaws Let Remote Users Deny Service and Execute Arbitrary Code and Let Applications Obtain Potentially Sensitive Information and Gain Elevated Privileges
CentOS has issued a fix for the Linux Kernel for CentOS 6.
Oct 18 2016 (Red Hat Issues Fix for Linux Kernel) Google Android Multiple Flaws Let Remote Users Deny Service and Execute Arbitrary Code and Let Applications Obtain Potentially Sensitive Information and Gain Elevated Privileges
Red Hat has issued a fix for the Linux Kernel for Red Hat Enterprise Linux 6.5.
Nov 2 2016 (Red Hat Issues Fix for Linux Kernel) Google Android Multiple Flaws Let Remote Users Deny Service and Execute Arbitrary Code and Let Applications Obtain Potentially Sensitive Information and Gain Elevated Privileges
Red Hat has issued a fix for Red Hat Enterprise Linux 6.6.
Nov 2 2016 (Red Hat Issues Fix for Linux Kernel) Google Android Multiple Flaws Let Remote Users Deny Service and Execute Arbitrary Code and Let Applications Obtain Potentially Sensitive Information and Gain Elevated Privileges
Red Hat has issued a fix for Red Hat Enterprise Linux 6.4.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC