National Cyber-Alert System

Vulnerability Summary for CVE-2009-2348

Overview

Android 1.5 CRBxx allows local users to bypass the (1) Manifest.permission.CAMERA (aka android.permission.CAMERA) and (2) Manifest.permission.AUDIO_RECORD (aka android.permission.RECORD_AUDIO) configuration settings by installing and executing an application that does not make a permission request before using the camera or microphone.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: android-permission-security-bypass(51798)

Hyperlink:http://xforce.iss.net/xforce/xfdb/51798

External Source: BID

Name: 35717

Hyperlink:http://www.securityfocus.com/bid/35717

External Source: BUGTRAQ

Name: 20090716 [oCERT-2009-011] Android improper camera and audio permission verification

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/505012/100/0/threaded

External Source: MLIST

Name: [oss-security] 20090716 [oCERT-2009-011] Android improper camera and audio permission verification

Hyperlink:http://www.openwall.com/lists/oss-security/2009/07/16/4

External Source: MISC

Name: http://www.ocert.org/advisories/ocert-2009-011.html

Hyperlink:http://www.ocert.org/advisories/ocert-2009-011.html

External Source: CONFIRM

Name: http://android.git.kernel.org/?p=platform/packages/apps/Camera.git;a=commit;h=e655d54160e5a56d4909f2459eeae9012e9f187f

Type: Advisory

Hyperlink:http://android.git.kernel.org/?p=platform/packages/apps/Camera.git;a=commit;h=e655d54160e5a56d4909f2459eeae9012e9f187f

External Source: CONFIRM

Name: http://android.git.kernel.org/?p=platform/frameworks/base.git;a=commit;h=7b7225c8fdbead25235c74811b30ff4ee690dc58

Type: Advisory

Hyperlink:http://android.git.kernel.org/?p=platform/frameworks/base.git;a=commit;h=7b7225c8fdbead25235c74811b30ff4ee690dc58

External Source: CONFIRM

Name: http://android.git.kernel.org/?p=platform/frameworks/base.git;a=commit;h=4d8adefd35efdea849611b8b02d61f9517e47760

Type: Advisory

Hyperlink:http://android.git.kernel.org/?p=platform/frameworks/base.git;a=commit;h=4d8adefd35efdea849611b8b02d61f9517e47760