Improper Neutralization of Special Elements in Output Used by a Downstream Component in Google, Google Android

1) Improper Neutralization of Special Elements in Output Used by a Downstream Component

EUVDB-ID: #VU39189

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2016-1155

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

HTTP header injection vulnerability in the URLConnection class in Android OS 2.2 through 6.0 allows remote attackers to execute arbitrary scripts or set arbitrary values in cookies.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Android: 2.2 - 6.0

CPE2.3

• cpe:2.3:o:google:android:2.2:*:*:*:*:*:*:*
• cpe:2.3:o:google:android:*:*:*:*:*:*:*:*

External links

https://www.securityfocus.com/bid/97662
https://android.googlesource.com/platform/external/okhttp/+/71b9f47b26fb57ac3e436a19519c6e3ec70e86eb
https://jvn.jp/vu/JVNVU99757346/index.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.