The Inquirer-Home

Android vulnerabilities revealed

Denial of service flaws
Mon Oct 12 2009, 09:59

INSECURITY RESEARCHERS have disclosed two vulnerabilities in Google's Android mobile platform that could lead to denial-of-service attacks.

The Open Source Computer Emergency Response Team (OCERT) warned of two flaws in version 1.5 of the increasingly popular platform, both of which have been patched by Google.

The first involves Android's handling of text messages, according to the OCERT security advisory.

"A specific malformed SMS can be crafted to trigger a condition that disconnects the mobile phone from the cellular network," read the advisory.

"The malformed SMS consists of a badly formatted WAP Push message which causes a Java ArrayIndexOutOfBoundsException in the phone application (android.com.phone)."

The phone application then silently reboots, leading to temporary loss of connectivity and dropped calls. If the phone's SIM is protected by a PIN, users will be required to re-enter the code, causing more delays and inconvenience, and if the bug is triggered repeatedly it could lead to denial of service, said OCERT.

The second flaw is a vulnerability in Android's Dalvik API. "A specific malicious application can be crafted so that, if it is downloaded and executed by the user, it would trigger the vulnerable API function and restart the system process," said OCERT.

"The same condition could occur if a developer unintentionally places the vulnerable function in a place where the execution path leads to that function call. Triggering this bug is considered a denial-of-service condition." µ

 

Share this:

blog comments powered by Disqus
Advertisement
Subscribe to INQ newsletters

Sign up for INQbot – a weekly roundup of the best from the INQ

Advertisement
INQ Poll

Masque malware is putting iPad and iPhone user data at risk

Has news of iOS malware made you reconsider getting an iPhone?