what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Android OS Authorization Missing

Android OS Authorization Missing
Posted Jul 5, 2014
Site curesec.com

Android OS suffers from multiple authorization issues.

tags | advisory
advisories | CVE-2013-6272, CVE-2013-6276
SHA-256 | 07b7bad6e5a342e4c6064572d91885c9ae462e065782f5ca1a374b0af8856fb0

Android OS Authorization Missing

Change Mirror Download
Hi List,

we are pleased to announce the public disclosure of two new bugs in
Android OS.

1. CVE-2013-6272 com.android.phone

Introduction

We conducted a deep investigation of android components and created some
CVEs and reported bugs to the Android Security Team in late 2013. Today
we want to publish one reported and one similar vulnerability.
Credits

Affectect Versions:
Version SDK Affected
4.1.1 16 Vulnerable
4.1.2 16 Vulnerable
4.2.2 17 Vulnerable
4.4.2 19 Vulnerable
4.4.4 19 Not Vulnerable

Please find the full advisory here:
https://blog.curesec.com/article/blog/35.html

2. CVE-2014-N/A com.android.contacts

Introduction

This bug is similar to CVE-2013-6276 but is only exploitable on older
Android versions. The bug exists in the component com.android.contacts.
Credits

Affectect Versions:

Version SDK Affected
2.3.3 10 Vulnerable
2.3.6 10 Vulnerable
3.0 11 Not Vulnerable
3.2 13 Not Vulnerable
4.0 14 Not Vulnerable
4.0.3 15 Not Vulnerable

This bug is not related to CVE-2013-6276 but has the same result.
Reading the source code it probably exists at least from version 1.5.
However we have only tested with SDK 10.

Please find the full advisory here:
https://blog.curesec.com/article/blog/36.html

- FAQ -
1. Why is this a bug?
Android normally has to grant permission so that your applications can
conduct actions. If your installed application does not own the right to
do a phone call, the Android OS should throw a permission denied.

However this bug is circumventing the situation and allows any malicous
app to do a phone call, send mmi or ussd codes or hangup an ongoing call.

2. Is there an app to test this issue on my phone?
You can use the APK we published. You will find details in the next
sections.

3. How would an attacker abuse this?
This bug can be abused by a malicious application. Take a simple game
which is coming with this code. The game wont ask you for extra
permissions to do a phone call to a toll number - but it is able to do it.

This is normally not possible without giving the app this special
permission. But not only might it be disturbing or expensive for someone
to call a toll number or getting ongoing calls hung up. It is also
possible to send USSD codes.

The list of USSD/SS/MMI codes is long and there are several quite
powerful ones like changing the flow of phone calls(forwarding),
blocking your simcard, enable or disable caller anonymisation and so on.

Please note that Curesec GmbH is not responsible for any damage your
device might suffer while you try to execute such codes.

4. Are tools which revoke permissions from apps blocking this attack?
No. As the app does not have the permission but is abusing a bug, such
apps cannot easily protect you from this without the knowledge that this
bug exists in another class on the system.

5. How can I contact you?

security@curesec.com

Downloads:
http://www.curesec.com/data/CRT-Kolme.apk -- Test application
http://www.curesec.com/data/CRT-Kolme.7z -- Source code
http://www.curesec.com/data/dz_exploits.tar.bz2 -- exploits for drozer


Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close