-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

CVE-2015-1835: Remote exploit of secondary configuration variables in 
               Apache Cordova on Android

Severity:      High

Vendor:        The Apache Software Foundation

Versions Affected:
               Cordova Android up to 4.0.1 (3.7.2 excluded)

Description:

Android applications built with the Cordova framework that don't have 
explicit values set in Config.xml can have undefined configuration 
variables set by Intent.  This can cause unwanted dialogs appearing 
in applications and changes in the application behaviour that can 
include the app force-closing.

The latest release of Cordova Android entirely removes the ability 
of configuration parameters to be set by intents.  This change is 
an API change in the platform, and third-party plugins that use 
values set in the config.xml should make sure that they use the 
preferences API instead of relying on the Intent bundle, whcih 
can be manipulated in this case.

Upgrade path:

Developers who are concerned about this should rebuild their 
applications with either Cordova Android 4.0.2, or Cordova 3.7.4 
if they are unable to upgrade to Cordova 4.0.2. Developers should 
also make sure that variables that they wish to have protected 
are specified in their config.xml.

Credit:

This issue was discovered by Seven Shen of Trend Micro Mobile Threat Research Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0
Comment: This message is encrypted and/or signed with PGP (gnu-pg, gpg). Contact dirkx@webweaving.org if you cannot read it.

iQCVAwUBVWbyfDGmPZbsFAuBAQim5gP8C/3m6DPI4YljLINtgtXgK+NOI2InjBPI
MA0bb10da+XUCLrcHoJnMHdBL2aGhltnKapNjp4I4gph0QIkhlhIUXelHojPSjRH
3ectaNsFCTJHofHKiMROtH3Fb5Gqo5U7LPtduvjCE4q/rJB/9LOHIojwWw/VqQo3
eBPdk/6bSaw=
=ax4a
-----END PGP SIGNATURE-----