CVE-2009-1754
Android 1.5-1.5 CRB42 - Improper Authentication via Shared User ID Request
Title source: llmDescription
The PackageManagerService class in services/java/com/android/server/PackageManagerService.java in Android 1.5 through 1.5 CRB42 does not properly check developer certificates during processing of sharedUserId requests at an application's installation time, which allows remote user-assisted attackers to access application data by creating a package that specifies a shared user ID with an arbitrary application.
References (5)
Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/35090
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2009/05/22/14
Patch x_refsource_misc
http://www.ocert.org/advisories/ocert-2009-006.html
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/503770
Scores
EPSS
0.0068
EPSS Percentile
47.8%
Details
CWE
CWE-287
Status
published
Products (1)
google/android
1.5
Published
May 26, 2009
Tracked Since
Feb 18, 2026