Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 8 Feb 2014 09:01:51 -0500 (EST)
Subject: Re: CVE Request: Multiple security issues in Android Debug Bridge (Android SDK Tools)

Hash: SHA1


> First, the integer "n" is signed. Second, the "strtoul" function
> allows specifying whether or not the number is negative

> results in a vanilla stack buffer overflow.

Use CVE-2014-1909 for this issue with incorrect use of an integer

> no authentication is required between the Client and Server
> 2.The ADB Server ... Among other things, it implements port forwarding
> and maintaining a persistent connection to devices connected to the
> host computer.
> these design decisions leave much to be desired.

There is no CVE assignment for this. Here, "no authentication is
required" is probably best considered an opportunity for security
enhancement. (For example, there are many other applications that
provide other types of port forwarding in other contexts, and don't
implement authentication.)

> Issue #2 - Lack of hardening when compiling for a host
> When investigating whether or not this particular issue was
> exploitable, it was determined that the "adb" binary supplied by
> Google does not contain two crucial modern protection mechanisms.
> Those are: non-executable stack protection and binary base
> randomization (PIE). Since these two protections are absent,
> exploiting this issue is trivial. A patch that adds these protections
> when compiling host binaries is included, though its is not well
> tested.
> It should also be noted that host compilation also seems to
> intentionally opt out of the FORTIFY_SOURCE protections. It's not
> clear why this is the case since the comment near this line of code
> references an internal only bug number.

There is currently no CVE assignment for this. Absense of these types
of protection mechanisms can have a CVE ID in some cases, but the CVE
project typically proceeds only in instances where an upstream vendor
chooses to make an announcement that this was a software mistake. An
example is CVE-2013-5057. A third-party report could be used in a
limited set of scenarios, e.g., a build process that has a list of
files requiring safe compilation options, with a typo in one of the
filenames. Similarly, if the available information is that the vendor
intentionally disabled this type of a protection mechanism, a CVE
assignment can't be made.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through ]
Version: GnuPG v1.4.14 (SunOS)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.