Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 20 Nov 2015 11:39:56 -0800
From: Joe Bowser <bowserj@...il.com>
To: DAVIDKA@...ibm.com, Roee Hay <ROEEH@...ibm.com>, 
	"private@...dova.apache.org" <private@...dova.apache.org>, dev <dev@...dova.apache.org>, 
	"security@...che.org" <security@...che.org>, oss-security@...ts.openwall.com, 
	bugtraq@...urityfocus.com
Subject: CVE-2015-5257 - Weak Randomization of BridgeSecret for Apache Cordova Android

===================================================================
CVE-2015-5257: Weak Randomization of BridgeSecret for Apache Cordova Android

Severity: Low

Vendor:
The Apache Software Foundation

Versions Affected:
Cordova Android versions up to and including 3.6.4

Description:

Cordova uses a bridge that allows the Native Application to communicate
with the HTML and Javascript that control the user interface.  To protect
this bridge on Android, the
framework uses a BridgeSecret to protect it from third-party hijacking.
However, the BridgeSecret is not sufficiently random and can be determined
in certain scenarios.

Upgrade Path:
Developers who are concerned about this issue should rebuild their
applications with Cordova Android 4.1.1 or later.  Version 3.7.1 and later
do not contain this vulnerability.

Credit: David Kaplan & Roee Hay, IBM X-Force Application Security Research
Team.

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.