Google Android up to 4.2 AndroidManifest.xml

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Google Android up to 4.2. This affects an unknown part of the file AndroidManifest.xml. The manipulation leads to an unknown weakness. In addition, an exploit is available.

Detailsinfo

A vulnerability was found in Google Android up to 4.2 (Smartphone Operating System). It has been rated as problematic. This issue affects an unknown functionality of the file AndroidManifest.xml. Impacted is confidentiality, and integrity.

The weakness was presented 06/06/2013 as not defined blog post (Website). It is possible to read the advisory at securelist.com. The vendor was not involved in the public release. Attacking locally is a requirement. The successful exploitation needs a simple authentication. Technical details as well as a private exploit are known. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 03/19/2019). It is expected to see the exploit prices for this product increasing in the near future.

It is declared as proof-of-concept. By approaching the search of inurl:AndroidManifest.xml it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at OSVDB (94186†). thehackernews.com is providing further details. See VDB-9144 for similar entry. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 1.0
• 1.1
• 1.5
• 1.6
• 2.0
• 2.0.1
• 2.1
• 2.2
• 2.2.1
• 2.2.2
• 2.2.3
• 2.3
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 2.3.6
• 2.3.7
• 3.0
• 3.1
• 3.2
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.2.5
• 3.2.6
• 4.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.1
• 4.1.1
• 4.1.2
• 4.2

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion