Security vulnerabilities were detected on the device. Sony C2305 (Sony) Android 4.2.2 Build 16.0.B.2.16 English/India (en_IN) Security Advisor v1.0.23 Last scan: 05-Oct-2014 12:47:55 AM Vulnerable software: 1 Total Vulnerabilities: 5 Vulnerable Software Android OS / version 4.2.2 Vulnerabilities: 5 Severity: 4 High, 1 Moderate Severity: 9.3, CVE-2013-4787, Master Key Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file (APK) that is modified in a way that does not violate the cryptographic signature, probably involving multiple entries in a Zip file with the same name in which one entry is validated but the other entry is installed, aka Android security bug 8219321 and the Master Key vulnerability. Severity: 8.8, CVE-2013-6271, Remove Device Locks Android 4.0 through 4.3 allows attackers to bypass intended access restrictions and remove device locks via a crafted application that invokes the updateUnlockMethodAndFinish method in the com.android.settings.ChooseLockGeneric class with the PASSWORD_QUALITY_UNSPECIFIED option. Severity: 7.5, CVE-2013-7373 Android before 4.4 does not properly arrange for seeding of the OpenSSL PRNG, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging use of the PRNG within multiple applications. Severity: 7.5, CVE-2014-1939 java/android/webkit/BrowserFrame.java in Android before 4.4 uses the addJavascriptInterface API in conjunction with creating an object of the SearchBoxImpl class, which allows attackers to execute arbitrary Java code by leveraging access to the searchBoxJavaBridge_ interface at certain Android API levels. Severity: 5.0, CVE-2013-7372 The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNG_SecureRandomImpl.java in the SecureRandom implementation in Apache Harmony through 6.0M3, as used in the Java Cryptography Architecture (JCA) in Android before 4.4 and other products, when no seed is provided by the user, uses an incorrect offset value, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging the resulting PRNG predictability, as exploited in the wild against Bitcoin wallet applications in August 2013.
Posted on: Sun, 05 Oct 2014 02:07:05 +0000
Trending Topics
Recently Viewed Topics
© 2015