Issue #1257: Installer Hijacking vulnerability - Replicant

Actions

Copy link

Issue #1257

closed

MS MS

Installer Hijacking vulnerability

Issue #1257: Installer Hijacking vulnerability

Added by My Self over 11 years ago. Updated about 11 years ago.

Status:

Closed

Priority:

High

Assignee:

My Self

Category:

Security

Target version:

Any version

Start date:

03/30/2015

Due date:

% Done:

100%

Estimated time:

Resolution:

fixed

Device:

Grant:

Type of work:

Description

I've checked, that Replicant is vulnerable to the Installer Hijacking vulnerability.
More informations: http://researchcenter.paloaltonetworks.com/2015/03/android-installer-hijacking-vulnerability-could-expose-android-users-to-malware/

Solution/Patch
Android diff: https://android.googlesource.com/platform/packages/apps/PackageInstaller/+/2b3202c3ff18469b294629bf1416118f12492173

Files

Add-manifest-to-verification-params.patch (4.99 KB) Add-manifest-to-verification-params.patch

My Self, 08/26/2015 11:38 AM

MS Updated by My Self over 11 years ago Actions
Copy link
#1

I have to wait until the Replicant sources are fetchable again:
http://redmine.replicant.us/boards/15/topics/8817

MS Updated by My Self about 11 years ago Actions
Copy link
#2

File Add-manifest-to-verification-params.patch added

The sources are up again.
So I decided to attach the patch listed above, (and tested with the current Replicant 4.2 sources) on this ticket.
After flashing the patched Replicant, I've tested my productive device several days without any misbehavior.
Furthermore I've successfully checked, that Replicant isn't vulnerale to the "Installer Hijacking Vulnerability" anymore.

@everyone: please review the patch and apply it if you like.