CVE-2014-1670 in Bing
Summary
by MITRE
The Microsoft Bing application before 4.2.1 for Android allows remote attackers to install arbitrary APK files via vectors involving a crafted DNS response.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/17/2018
The vulnerability identified as CVE-2014-1670 represents a critical security flaw in the Microsoft Bing application for Android devices prior to version 4.2.1. This vulnerability falls under the category of insecure direct object reference and insecure communication protocols, specifically exploiting weaknesses in how the application handles DNS resolution and subsequent package installation processes. The flaw enables remote attackers to manipulate the application's behavior through malicious DNS responses, creating a pathway for arbitrary code execution and unauthorized application installation on affected devices.
The technical implementation of this vulnerability stems from the Bing application's failure to properly validate DNS responses during the download and installation process of APK files. When users interact with Bing search results or web content that triggers automatic downloads, the application relies on DNS resolution to determine the source of downloadable content. Attackers can exploit this by poisoning DNS records or manipulating the DNS resolution process to redirect the application to malicious servers hosting crafted APK files. The vulnerability specifically affects the application's trust model, where it accepts DNS responses without sufficient verification mechanisms to ensure the legitimacy of the content source.
The operational impact of CVE-2014-1670 extends beyond simple unauthorized application installation, creating a vector for broader compromise of Android devices. Once an attacker successfully installs an arbitrary APK file through this vulnerability, they gain the ability to execute malicious code with the permissions granted to the Bing application. This could lead to data exfiltration, device control, persistent backdoor installation, and other malicious activities. The vulnerability affects millions of Android users who were running affected versions of the Bing application, creating a significant attack surface for threat actors. The exploitation requires minimal user interaction beyond normal application usage, making it particularly dangerous as it can be triggered through standard search queries or web browsing activities.
This vulnerability aligns with several ATT&CK techniques including T1190 (Exploit Public-Facing Application) and T1059 (Command and Scripting Interpreter), as it exploits a public-facing application to install malicious payloads. From a CWE perspective, this vulnerability corresponds to CWE-20: Improper Input Validation and CWE-352: Cross-Site Request Forgery, though it manifests more specifically through DNS manipulation and trust model exploitation. The weakness demonstrates poor input validation in network communications and inadequate trust verification mechanisms. Organizations should implement immediate mitigations including updating to Microsoft Bing version 4.2.1 or later, deploying network monitoring solutions to detect DNS poisoning attempts, and educating users about the risks of clicking on suspicious search results or links. Additionally, network administrators should consider implementing DNS security measures such as DNSSEC to prevent DNS response manipulation and strengthen overall network security posture against similar vulnerabilities.