oss-sec mailing list archives
Re: CVE Request: Multiple security issues in Android Debug Bridge (Android SDK Tools)
From: cve-assign () mitre org
Date: Sat, 8 Feb 2014 09:01:51 -0500 (EST)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
http://www.droidsec.org/advisories/2014/02/04/two-security-issues-found-in-the-android-sdk-tools.html
First, the integer "n" is signed. Second, the "strtoul" function allows specifying whether or not the number is negative
results in a vanilla stack buffer overflow.
Use CVE-2014-1909 for this issue with incorrect use of an integer value.
no authentication is required between the Client and Server 2.The ADB Server ... Among other things, it implements port forwarding and maintaining a persistent connection to devices connected to the host computer. these design decisions leave much to be desired.
There is no CVE assignment for this. Here, "no authentication is required" is probably best considered an opportunity for security enhancement. (For example, there are many other applications that provide other types of port forwarding in other contexts, and don't implement authentication.)
Issue #2 - Lack of hardening when compiling for a host When investigating whether or not this particular issue was exploitable, it was determined that the "adb" binary supplied by Google does not contain two crucial modern protection mechanisms. Those are: non-executable stack protection and binary base randomization (PIE). Since these two protections are absent, exploiting this issue is trivial. A patch that adds these protections when compiling host binaries is included, though its is not well tested. It should also be noted that host compilation also seems to intentionally opt out of the FORTIFY_SOURCE protections. It's not clear why this is the case since the comment near this line of code references an internal only bug number.
There is currently no CVE assignment for this. Absense of these types of protection mechanisms can have a CVE ID in some cases, but the CVE project typically proceeds only in instances where an upstream vendor chooses to make an announcement that this was a software mistake. An example is CVE-2013-5057. A third-party report could be used in a limited set of scenarios, e.g., a build process that has a list of files requiring safe compilation options, with a typo in one of the filenames. Similarly, if the available information is that the vendor intentionally disabled this type of a protection mechanism, a CVE assignment can't be made. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJS9jfCAAoJEKllVAevmvmsiqUIAMUIIWCkDc4ECZB7Ic2AM6VB TKRl+AB5ZwBxvJzdr1IOvx1yg0dVdwHq6A/Fe+MGFr/SlVTGHOu4tIbBYCAmFlkM QCtSEuIwLYaIo63Qw/SM7HDIcvmPDlcY9hqcH5g3GOHTA6s0j/nNG/w7N9uGjZrK kw9CqjniX32cTUJdL2X1wrLlbc+BJlply5HkTMFseCRCd9WT4RBsENhPgBPOB64p LZ0MzOTOD+l8uN6CDblURnP5uq7eZ8dyOJm3PVNA/xdyMe4i0wj7BaL83zHrCrya JxKtEKTbNzt7SE++VXhv0HpZuy4BvH3A9QlWpJcbBg2mB3BCsp/kSzbr1fDLYbw= =Nfx1 -----END PGP SIGNATURE-----
Current thread:
- CVE Request: Multiple security issues in Android Debug Bridge (Android SDK Tools) Arun Neelicattu (Feb 05)
- Re: CVE Request: Multiple security issues in Android Debug Bridge (Android SDK Tools) cve-assign (Feb 08)