Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE Request: Multiple security issues in Android Debug Bridge (Android SDK Tools)
From: cve-assign () mitre org
Date: Sat, 8 Feb 2014 09:01:51 -0500 (EST)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://www.droidsec.org/advisories/2014/02/04/two-security-issues-found-in-the-android-sdk-tools.html

First, the integer "n" is signed. Second, the "strtoul" function
allows specifying whether or not the number is negative

results in a vanilla stack buffer overflow.

Use CVE-2014-1909 for this issue with incorrect use of an integer
value.


no authentication is required between the Client and Server

2.The ADB Server ... Among other things, it implements port forwarding
and maintaining a persistent connection to devices connected to the
host computer.

these design decisions leave much to be desired.

There is no CVE assignment for this. Here, "no authentication is
required" is probably best considered an opportunity for security
enhancement. (For example, there are many other applications that
provide other types of port forwarding in other contexts, and don't
implement authentication.)


Issue #2 - Lack of hardening when compiling for a host

When investigating whether or not this particular issue was
exploitable, it was determined that the "adb" binary supplied by
Google does not contain two crucial modern protection mechanisms.
Those are: non-executable stack protection and binary base
randomization (PIE). Since these two protections are absent,
exploiting this issue is trivial. A patch that adds these protections
when compiling host binaries is included, though its is not well
tested.

It should also be noted that host compilation also seems to
intentionally opt out of the FORTIFY_SOURCE protections. It's not
clear why this is the case since the comment near this line of code
references an internal only bug number.

There is currently no CVE assignment for this. Absense of these types
of protection mechanisms can have a CVE ID in some cases, but the CVE
project typically proceeds only in instances where an upstream vendor
chooses to make an announcement that this was a software mistake. An
example is CVE-2013-5057. A third-party report could be used in a
limited set of scenarios, e.g., a build process that has a list of
files requiring safe compilation options, with a typo in one of the
filenames. Similarly, if the available information is that the vendor
intentionally disabled this type of a protection mechanism, a CVE
assignment can't be made.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJS9jfCAAoJEKllVAevmvmsiqUIAMUIIWCkDc4ECZB7Ic2AM6VB
TKRl+AB5ZwBxvJzdr1IOvx1yg0dVdwHq6A/Fe+MGFr/SlVTGHOu4tIbBYCAmFlkM
QCtSEuIwLYaIo63Qw/SM7HDIcvmPDlcY9hqcH5g3GOHTA6s0j/nNG/w7N9uGjZrK
kw9CqjniX32cTUJdL2X1wrLlbc+BJlply5HkTMFseCRCd9WT4RBsENhPgBPOB64p
LZ0MzOTOD+l8uN6CDblURnP5uq7eZ8dyOJm3PVNA/xdyMe4i0wj7BaL83zHrCrya
JxKtEKTbNzt7SE++VXhv0HpZuy4BvH3A9QlWpJcbBg2mB3BCsp/kSzbr1fDLYbw=
=Nfx1
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]