[<prev] [next>] [day] [month] [year] [list]
Message-Id: <69AEC4CC-A12D-459C-8FDF-E5072D9E10DC@gmail.com>
Date: Mon, 11 Aug 2014 18:09:59 -0400
From: Marcel Kinard <cmarcelk@...il.com>
To: dev@...dova.apache.org,
security@...che.org,
oss-security@...ts.openwall.com,
bugtraq@...urityfocus.com
Subject: Apache Cordova 3.5.1: CVE-2014-3502 update
The following text is amended from the original that was sent on August 4th. More background information on this amendment can be found at http://cordova.apache.org/announcements/2014/08/06/android-351-update.html
Android Platform Release: 04 Aug 2014
CVE-2014-3502: Cordova apps can potentially leak data to other apps via URL
loading
Severity: Medium
Vendor:
The Apache Software Foundation
Versions Affected:
Cordova Android versions up to 3.5.0
Description:
Android applications built with the Cordova framework can launch other
applications through the use of anchor tags, or by redirecting the webview to
an Android intent URL. An attacker who can manipulate the HTML content of a
Cordova application can create links which open other applications and send
arbitrary data to those applications. An attacker who can run arbitrary
JavaScript code within the context of the Cordova application can also set the
document location to such a URL. By using this in concert with a second,
vulnerable application, an attacker might be able to use this method to send
data from the Cordova application to the network.
The latest release of Cordova Android takes steps to block explicit Android
intent urls, so that they can no longer be used to start arbitrary applications
on the device.
Implicit intents, including URLs with schemes such as "tel", "geo", and "sms"
can still be used to open external applications by default, but this behaviour
can be overridden by plugins.
Upgrade path:
Developers who are concerned about this should rebuild their applications with
Cordova Android 3.5.1.
Credit:
This issue was discovered by David Kaplan and Roee Hay of IBM Security Systems.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
