VDB-11334 · OSVDB 100409 · GCVE-100-11334

Google Android 4.2/4.4 于 Nexus Flash Message 拒绝服务

CVSS 元临时分数	当前攻击价格 (≈)	CTI兴趣分数
6.5	$0-$5k	0.00

摘要信息

在Google Android 4.2/4.4中曾发现一漏洞, 此漏洞被申报为棘手。此漏洞会影响未知代码的组件Flash Message Handler。手动调试的不合法输入可导致拒绝服务。而且，有现成的漏洞利用。

在Google Android 4.2/4.4中曾发现一漏洞, 此漏洞被申报为棘手。此漏洞会影响未知代码的组件Flash Message Handler。手动调试的不合法输入可导致拒绝服务。通过 CWE 声明此问题将指向 CWE-404。此漏洞的脆弱性 2013-11-29由公示人Bogdan Alecu、公示人身份SMS Vulnerability In Nexus Phones Can Be Exploited To Force A Reboot Or Kill Cellular Connectivity、公示人类型为公告 (网站)所分享。请访问 androidpolice.com 下载该通告。供应商未曾参与此次公开发布。

未提供技术细节。该漏洞的知名度低于平均水平，而且，有现成的漏洞利用。该漏洞利用已公开，攻击者可能会加以利用。目前，大约是 USD $0-$5k。公告指出：

The method of attack simply relies on sending a series of Class 0 "Flash" messages to the target phone. Flash messages are typically used for emergency or security purposes, appearing on the screen immediately instead of going to the default SMS application. When such a message arrives, no sounds are made but the background is dimmed and a single dialog box appears on top. Once 20-30 messages pile up, assuming the user isn't clearing them, it overloads the system and leads to a few potential side-effects. Most commonly, the result is an unresponsive device or an immediate reboot, but the Messages app or cellular radio may occasionally crash or freeze up in some instances.

它被宣布为概念验证。可在vimeo.com获取该漏洞利用代码。 0日漏洞的地下市场估价大致为$25k-$100k。