CVSS: 10.0EPSS: 0%CPEs: 9EXPL: 0CVE-2011-2344
https://notcve.org/view.php?id=CVE-2011-2344
Android Picasa in Android 3.0 and 2.x through 2.3.4 uses a cleartext HTTP session when transmitting the authToken obtained from ClientLogin, which allows remote attackers to gain privileges and access private pictures and web albums by sniffing the token from connections with picasaweb.google.com. Android Picasa en Android v3.0 y v2.x hasta v2.3.4 usa sesion HTTP en texto claro cuando se transmite el authToken obtenido de ClientLogin, lo que permite a usuarios remotos ganar privilegios y acceder a imagenes y albumes privados esnifando el token de conexiones con picasaweb.google.com • http://android.git.kernel.org/?p=platform/packages/apps/Gallery3D.git%3Ba=commit%3Bh=7a763db1c15bb6436be85a3f23382e4171970b6e http://android.git.kernel.org/?p=platform/packages/apps/Gallery3D.git%3Ba=commit%3Bh=9a418de454e5ce078c98f41b5c18e3bb9175bd20 http://www.uni-ulm.de/en/in/mi/staff/koenings/catching-authtokens.html • CWE-310: Cryptographic Issues •
CVSS: 4.3EPSS: 12%CPEs: 9EXPL: 1CVE-2010-4804 – Google Android - 'content://' URI Multiple Information Disclosure Vulnerabilities
https://notcve.org/view.php?id=CVE-2010-4804
The Android browser in Android before 2.3.4 allows remote attackers to obtain SD card contents via crafted content:// URIs, related to (1) BrowserActivity.java and (2) BrowserSettings.java in com/android/browser/. El navegador de Android antes de la v2.3.4 de Android permite a atacantes remotos obtener el contenido de tarjetas SD a través de peticiones content://URIs, en relación con (1) BrowserActivity.java y (2) BrowserSettings.java en com/android/browser. Android versions prior to 2.3.4 suffer from content:// URI information disclosure vulnerabilities. • https://www.exploit-db.com/exploits/18164 http://android.git.kernel.org/?p=platform/frameworks/base.git%3Ba=commit%3Bh=f440831d76817e837164ca18c7705e81d2391f87 http://android.git.kernel.org/?p=platform/packages/apps/Browser.git%3Ba=commit%3Bh=604a598e1e01bda781600a45e0a971898a582666 http://thomascannon.net/blog/2010/11/android-data-stealing-vulnerability http://www.csc.ncsu.edu/faculty/jiang/nexuss.html http://www.securityfocus.com/bid/48256 http://www.slashgear.com/android-data-theft-exploit-to-be-plugged-in& • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 3CVE-2011-1823 – Android OS Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2011-1823
The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak. El demonio de vold volume manager en Android versión 3.0 y versiones 2.x anterior a 2.3.4, confía en los mensajes que son recibidos desde un socket PF_NETLINK, que permite a los usuarios locales ejecutar código arbitrario y alcanzar privilegios de root por medio de un índice negativo que omite la comprobación de un entero firmado maximum-only en el método DirectVolume::handlePartitionAdded, que activa una corrupción de memoria, como es demostrado por Gingerbreak. The vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor. • http://android.git.kernel.org/?p=platform/system/core.git%3Ba=commit%3Bh=b620a0b1c7ae486e979826200e8e441605b0a5d6 http://android.git.kernel.org/?p=platform/system/netd.git%3Ba=commit%3Bh=79b579c92afc08ab12c0a5788d61f2dd2934836f http://android.git.kernel.org/?p=platform/system/vold.git%3Ba=commit%3Bh=c51920c82463b240e2be0430849837d6fdc5352e http://androidcommunity.com/gingerbreak-root-for-gingerbread-app-20110421 http://c-skills.blogspot.com/2011/04/yummy-yummy-gingerbreak.html http://forum.xda-developers.com/showthread.php?t=104 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 1CVE-2011-1149
https://notcve.org/view.php?id=CVE-2011-1149
Android before 2.3 does not properly restrict access to the system property space, which allows local applications to bypass the application sandbox and gain privileges, as demonstrated by psneuter and KillingInTheNameOf, related to the use of Android shared memory (ashmem) and ASHMEM_SET_PROT_MASK. Android anterior a v2.3 no restringe de forma adecuada el acceso al espacio de propiedad del sistema, lo que permite a las aplicaciones locales evitar los privilegios de recinto de seguridad de aplicaciones y obtener privilegios, como lo demuestra psneuter y KillingInTheNameOf, relacionado con el uso de la memoria compartida Android (ashmem) y ASHMEM_SET_PROT_MASK. • http://android.git.kernel.org/?p=kernel/common.git%3Ba=commit%3Bh=c98a285075f26e2b17a5baa2cb3eb6356a75597e http://android.git.kernel.org/?p=platform/system/core.git%3Ba=commit%3Bh=25b15be9120bcdaa0aba622c67ad2c835d9e91ca http://c-skills.blogspot.com/2011/01/adb-trickery-again.html http://forum.xda-developers.com/wiki/index.php?title=HTC_Vision#Rooting_the_G2 http://groups.google.com/group/android-security-discuss/browse_thread/thread/15f97658c88d6827/e86db04652651971?show_docid=e86db04652651971 https://github.com/tmzt/g2 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 6EXPL: 0CVE-2011-0680
https://notcve.org/view.php?id=CVE-2011-0680
data/WorkingMessage.java in the Mms application in Android before 2.2.2 and 2.3.x before 2.3.2 does not properly manage the draft cache, which allows remote attackers to read SMS messages intended for other recipients in opportunistic circumstances via a standard text messaging service. data/WorkingMessage.java en la aplicación Mms en Android anterior a v2.2.2 y v2.3.x anterior a v2.3.2 no maneja adecuadamente la 'draft' caché, lo que permite a atacantes remotos leer mensajes SMS previstos para otros destinatarios en circustancias oportunas a través de un servicio estándar de mensajes de texto. • http://android.git.kernel.org/?p=platform/packages/apps/Mms.git%3Ba=commit%3Bh=18d6b7e9d2e538fb3c0264332b96c02abf367267 http://android.git.kernel.org/?p=platform/packages/apps/Mms.git%3Ba=commit%3Bh=4d26623ce82230e8e7009adb921c5edea370a9e0 http://code.google.com/p/android/issues/detail?id=9392#c1460 http://code.google.com/p/android/issues/detail?id=9392#c1620 http://phandroid.com/2011/01/21/android-2-3-2-update-pushing-to-nexus-s-phone-fixes-sms-bug http://twitter.com/GalaxySsupport/statuses/28078194 •