Hi List, we are pleased to announce the public disclosure of two new bugs in Android OS. 1. CVE-2013-6272 com.android.phone Introduction We conducted a deep investigation of android components and created some CVEs and reported bugs to the Android Security Team in late 2013. Today we want to publish one reported and one similar vulnerability. Credits Affectect Versions: Version SDK Affected 4.1.1 16 Vulnerable 4.1.2 16 Vulnerable 4.2.2 17 Vulnerable 4.4.2 19 Vulnerable 4.4.4 19 Not Vulnerable Please find the full advisory here: https://blog.curesec.com/article/blog/35.html 2. CVE-2014-N/A com.android.contacts Introduction This bug is similar to CVE-2013-6276 but is only exploitable on older Android versions. The bug exists in the component com.android.contacts. Credits Affectect Versions: Version SDK Affected 2.3.3 10 Vulnerable 2.3.6 10 Vulnerable 3.0 11 Not Vulnerable 3.2 13 Not Vulnerable 4.0 14 Not Vulnerable 4.0.3 15 Not Vulnerable This bug is not related to CVE-2013-6276 but has the same result. Reading the source code it probably exists at least from version 1.5. However we have only tested with SDK 10. Please find the full advisory here: https://blog.curesec.com/article/blog/36.html - FAQ - 1. Why is this a bug? Android normally has to grant permission so that your applications can conduct actions. If your installed application does not own the right to do a phone call, the Android OS should throw a permission denied. However this bug is circumventing the situation and allows any malicous app to do a phone call, send mmi or ussd codes or hangup an ongoing call. 2. Is there an app to test this issue on my phone? You can use the APK we published. You will find details in the next sections. 3. How would an attacker abuse this? This bug can be abused by a malicious application. Take a simple game which is coming with this code. The game wont ask you for extra permissions to do a phone call to a toll number - but it is able to do it. This is normally not possible without giving the app this special permission. But not only might it be disturbing or expensive for someone to call a toll number or getting ongoing calls hung up. It is also possible to send USSD codes. The list of USSD/SS/MMI codes is long and there are several quite powerful ones like changing the flow of phone calls(forwarding), blocking your simcard, enable or disable caller anonymisation and so on. Please note that Curesec GmbH is not responsible for any damage your device might suffer while you try to execute such codes. 4. Are tools which revoke permissions from apps blocking this attack? No. As the app does not have the permission but is abusing a bug, such apps cannot easily protect you from this without the knowledge that this bug exists in another class on the system. 5. How can I contact you? security@curesec.com Downloads:Roberto Palear http://www.curesec.com/data/CRT-Kolme.apk -- Test application http://www.curesec.com/data/CRT-Kolme.7z -- Source code http://www.curesec.com/data/dz_exploits.tar.bz2 -- exploits for drozer