[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] CVE-2015-1835: Remote exploit of secondary configuration variables in Apache Cordova 
From:       Joe Bowser <bowserj () gmail ! com>
Date:       2015-05-27 20:03:40
Message-ID: CAOBL_k5Urg=4CcANUOpqdfFk4x5V8=LmK0xL3AKcsNmhf7wNtw () mail ! gmail ! com
[Download RAW message or body]


=====================================================
CVE-2015-1835: Remote exploit of secondary configuration variables in
Apache Cordova on Android

Severity:
High

Vendor:
The Apache Software Foundation

Versions Affected:
Cordova Android up to 4.0.1 (3.7.2 excluded)

Description:
Android applications built with the Cordova framework that don't have
explicit values set in Config.xml can have undefined configuration
variables set by Intent.  This can cause unwanted dialogs appearing in
applications and changes in the application behaviour that can include the
app force-closing.

The latest release of Cordova Android entirely removes the ability of
configuration parameters to be set by intents.  This change is an API
change in the platform, and third-party plugins that use values set in the
config.xml should make sure that they use the preferences API instead of
relying on the Intent bundle, whcih can be manipulated in this case.

Upgrade path:
Developers who are concerned about this should rebuild their applications
with either Cordova Android 4.0.2, or Cordova 3.7.4 if they are unable to
upgrade to Cordova 4.0.2. Developers should also make sure that variables
that they wish to have protected are specified in their config.xml.

Credit:
This issue was discovered by Seven Shen of Trend Micro Mobile Threat
Research Team
==================================================


[prev in list] [next in list] [prev in thread] [next in thread]