#VU42738 Cryptographic issues in Google Android - CVE-2013-4787
Published: July 9, 2013 / Updated: August 11, 2020
Vulnerability identifier: #VU42738
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: CVE-2013-4787
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerable software:
Google Android
Google Android
Software vendor:
Google
Description
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file (APK) that is modified in a way that does not violate the cryptographic signature, probably involving multiple entries in a Zip file with the same name in which one entry is validated but the other entry is installed, aka Android security bug 8219321 and the "Master Key" vulnerability.
Remediation
Install update from vendor's website.
External links
- http://bluebox.com/corporate-blog/bluebox-uncovers-android-master-key/
- http://review.cyanogenmod.org/#/c/45251/
- http://www.osvdb.org/94773
- http://www.securityfocus.com/bid/60952
- http://www.zdnet.com/google-releases-fix-to-oems-for-blue-security-android-security-hole-7000017782/
- https://jira.cyanogenmod.org/browse/CYAN-1602
- https://plus.google.com/113331808607528811927/posts/GxDA6111vYy