Date: Wed, 27 May 2015 20:03:40 +0000 From: Joe Bowser <bowserj@...il.com> To: "private@...dova.apache.org" <private@...dova.apache.org>, "seven_shen@...ndmicro.com.cn" <seven_shen@...ndmicro.com.cn>, "security@...che.org" <security@...che.org>, oss-security@...ts.openwall.com, bugtraq@...urityfocus.com Subject: CVE-2015-1835: Remote exploit of secondary configuration variables in Apache Cordova on Android ===================================================== CVE-2015-1835: Remote exploit of secondary configuration variables in Apache Cordova on Android Severity: High Vendor: The Apache Software Foundation Versions Affected: Cordova Android up to 4.0.1 (3.7.2 excluded) Description: Android applications built with the Cordova framework that don't have explicit values set in Config.xml can have undefined configuration variables set by Intent. This can cause unwanted dialogs appearing in applications and changes in the application behaviour that can include the app force-closing. The latest release of Cordova Android entirely removes the ability of configuration parameters to be set by intents. This change is an API change in the platform, and third-party plugins that use values set in the config.xml should make sure that they use the preferences API instead of relying on the Intent bundle, whcih can be manipulated in this case. Upgrade path: Developers who are concerned about this should rebuild their applications with either Cordova Android 4.0.2, or Cordova 3.7.4 if they are unable to upgrade to Cordova 4.0.2. Developers should also make sure that variables that they wish to have protected are specified in their config.xml. Credit: This issue was discovered by Seven Shen of Trend Micro Mobile Threat Research Team ==================================================
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ