Stack-based buffer overflow in Google Android - CVE-2011-3874

Detailed vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing an application that calls the FrameworkListener::dispatchCommand method with the wrong number of arguments, as demonstrated by zergRush to trigger a use-after-free error. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

How to mitigate CVE-2011-3874

Sources

• http://code.google.com/p/android/issues/detail?id=21681
• http://www.openwall.com/lists/oss-security/2011/11/08/3
• http://www.openwall.com/lists/oss-security/2011/11/08/4
• http://www.openwall.com/lists/oss-security/2011/11/10/1
• https://github.com/revolutionary/zergRush/blob/master/zergRush.c