ID:7869 - Exploit for Permissions, Privileges, and Access Controls in Google Android - CVE-2014-8609

Link to public exploit:

Vulnerability description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The addAccount method in src/com/android/settings/accounts/AddAccountSettings.java in the Settings application in Android before 5.0.0 does not properly create a PendingIntent, which allows attackers to use the SYSTEM uid for broadcasting an intent with arbitrary component, action, or category information via a third-party authenticator in a crafted application, aka Bug 17356824.

Remediation