CVE-2009-1754

Google Android - Authentication Bypass

Title source: rule

Description

The PackageManagerService class in services/java/com/android/server/PackageManagerService.java in Android 1.5 through 1.5 CRB42 does not properly check developer certificates during processing of sharedUserId requests at an application's installation time, which allows remote user-assisted attackers to access application data by creating a package that specifies a shared user ID with an arbitrary application.

References (5)

[Patch] http://android.git.kernel.org/?p=platform/frameworks/base.git%3Ba=commit%3Bh=5d6d773fab559fdc12e553d60d789f3991ac552c

[Patch] http://www.ocert.org/advisories/ocert-2009-006.html

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/503770

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/35090

[Mailing List] http://www.openwall.com/lists/oss-security/2009/05/22/14

Scores

EPSS 0.0019

EPSS Percentile 40.7%

Classification

CWE

CWE-287

Status draft

Affected Products (1)

google/android

Timeline

Published May 26, 2009

Tracked Since Feb 18, 2026