Recently we detected a security vulnerability in Android’s SQLite engine which can be exploited by a non-privileged application in order to disclose sensitive information. It enables a malicious application to eavesdrop on database activities performed by any other application using SQLite, allowing unauthorized access to information such as URL history, messages, and contacts.
The complete advisory can be found here.
Demo of the PoC:
We would like to thank the Android Security Team for the efficient and quick way in which they handled this security issue.
How's Android Security Team handled this? What actions they did?
Posted by: Account Deleted | May 28, 2012 at 08:19 AM
They've hardened the file permissions of the journal file (patch is available on AOSP).
Posted by: Roee Hay | May 29, 2012 at 10:32 AM
How did they get a Android emulator running a Android 2.3.7 version?
Thx
Posted by: Account Deleted | June 20, 2012 at 03:45 PM
Why wouldn't they be able to?
Posted by: Roee Hay | June 21, 2012 at 02:05 PM