#VU39189 Improper Neutralization of Special Elements in Output Used by a Downstream Component in Google Android - CVE-2016-1155

Vulnerability identifier: #VU39189

Vulnerability risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2016-1155

CWE-ID: CWE-74

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Google Android
Operating systems & Components / Operating system

Vendor: Google

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

HTTP header injection vulnerability in the URLConnection class in Android OS 2.2 through 6.0 allows remote attackers to execute arbitrary scripts or set arbitrary values in cookies.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Google Android: 2.2 - 2.3.7, 3.0 - 3.2.6, 4.0 - 4.4.4, 5.0 - 5.1.1, 6.0

---

External links
https://www.securityfocus.com/bid/97662
https://android.googlesource.com/platform/external/okhttp/+/71b9f47b26fb57ac3e436a19519c6e3ec70e86eb
https://jvn.jp/vu/JVNVU99757346/index.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.