Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT Security Bulletin ASB-2019.0046 Android Security Bulletin - February 2019 5 February 2019 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Android Operating System: Android Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction Increased Privileges -- Remote with User Interaction Denial of Service -- Remote with User Interaction Access Confidential Data -- Remote with User Interaction Resolution: Patch/Upgrade CVE Names: CVE-2019-2001 CVE-2019-2000 CVE-2019-1999 CVE-2019-1998 CVE-2019-1997 CVE-2019-1996 CVE-2019-1995 CVE-2019-1994 CVE-2019-1993 CVE-2019-1992 CVE-2019-1991 CVE-2019-1988 CVE-2019-1987 CVE-2019-1986 CVE-2018-13905 CVE-2018-13904 CVE-2018-13900 CVE-2018-11948 CVE-2018-11945 CVE-2018-11938 CVE-2018-11935 CVE-2018-11932 CVE-2018-11931 CVE-2018-11921 CVE-2018-11864 CVE-2018-11845 CVE-2018-11820 CVE-2018-11289 CVE-2018-11280 CVE-2018-11275 CVE-2018-11268 CVE-2018-11262 CVE-2018-10879 CVE-2018-6271 CVE-2018-6268 CVE-2018-6267 CVE-2018-5839 CVE-2018-5269 CVE-2018-5268 CVE-2017-18009 CVE-2017-17760 CVE-2016-6684 Member content until: Thursday, March 7 2019 Reference: ESB-2018.2124 ESB-2018.1195 ASB-2016.0093 OVERVIEW Multiple security vulnerabilities have been identified in the Android operating system prior to the 2019-02-01 patch level. [1] IMPACT "Framework The most severe vulnerability in this section could enable a remote attacker using a specially crafted PNG file to execute arbitrary code within the context of a privileged process. CVE References Type Severity Updated AOSP versions CVE-2019-1986 A-117838472 RCE Critical 9 CVE-2019-1987 A-118143775 RCE Critical 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 CVE-2019-1988 A-118372692 RCE Critical 8.0, 8.1, 9 Library The most severe vulnerability in this section could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. CVE References Type Severity Updated AOSP versions CVE-2017-17760 A-78029030* RCE High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 CVE-2018-5268 A-78029634* RCE High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 CVE-2018-5269 A-78029727* RCE High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 CVE-2017-18009 A-78026242* ID Moderate 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 System The most severe vulnerability in this section could enable a remote attacker using a specially crafted transmission to execute arbitrary code within the context of a privileged process. CVE References Type Severity Updated AOSP versions CVE-2019-1991 A-110166268 RCE Critical 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 CVE-2019-1992 A-116222069 RCE Critical 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 CVE-2019-1993 A-119819889 EoP High 8.0, 8.1, 9 CVE-2019-1994 A-117770924 EoP High 8.0, 8.1, 9 CVE-2019-1995 A-32589229 ID High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 CVE-2019-1996 A-111451066 ID High 8.0, 8.1, 9 CVE-2019-1997 A-117508900 ID High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 CVE-2019-1998 A-116055338 DoS High 9 2019-02-05 security patch level vulnerability details In the sections below, we provide details for each of the security vulnerabilities that apply to the 2019-02-05 patch level. Vulnerabilities are grouped under the component they affect and include details such as the CVE, associated references, type of vulnerability, severity, component (where applicable), and updated AOSP versions (where applicable). When available, we link the public change that addressed the issue to the bug ID, such as the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID. Kernel components The most severe vulnerability in this section could enable a local malicious application to execute arbitrary code within the context of a privileged process. CVE References Type Severity Component CVE-2018-10879 A-116406063 EoP High ext4 filesystem Upstream kernel CVE-2019-1999 A-120025196* EoP High Binder driver CVE-2019-2000 A-120025789* EoP High Binder driver CVE-2019-2001 A-117422211* ID High iomem NVIDIA components The most severe vulnerability in this section could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of a privileged process. CVE References Type Severity Component CVE-2018-6271 A-80198474* RCE Critical libnvomx CVE-2018-6267 A-70857947* EoP High libnvomx CVE-2018-6268 A-80433161* EoP High libnvomx CVE-2016-6684 A-117423758* ID High kernel log Qualcomm components These vulnerabilities affect Qualcomm components and are described in further detail in the appropriate Qualcomm security bulletin or security alert. The severity assessment of these issues is provided directly by Qualcomm. CVE References Type Severity Component CVE-2018-11262 A-76424945 N/A Critical bootloader QC-CR#2221192 CVE-2018-11280 A-109741776 N/A High Modem QC-CR#2185061 CVE-2018-11275 A-74409078 N/A High Bootloader QC-CR#2221256 CVE-2018-13900 A-119052051 N/A High Modem QC-CR#2287499 CVE-2018-13905 A-119052050 N/A High Graphics QC-CR#2225202 Qualcomm closed-source components These vulnerabilities affect Qualcomm components and are described in further detail in the appropriate Qualcomm security bulletin or security alert. The severity assessment of these issues is provided directly by Qualcomm. CVE References Type Severity Component CVE-2018-11289 A-109678453* N/A Critical Closed-source component CVE-2018-11820 A-111089815* N/A Critical Closed-source component CVE-2018-11938 A-112279482* N/A Critical Closed-source component CVE-2018-11945 A-112278875* N/A Critical Closed-source component CVE-2018-11268 A-109678259* N/A High Closed-source component CVE-2018-11845 A-111088838* N/A High Closed-source component CVE-2018-11864 A-111092944* N/A High Closed-source component CVE-2018-11921 A-112278972* N/A High Closed-source component CVE-2018-11931 A-112279521* N/A High Closed-source component CVE-2018-11932 A-112279426* N/A High Closed-source component CVE-2018-11935 A-112279483* N/A High Closed-source component CVE-2018-11948 A-112279144* N/A High Closed-source component CVE-2018-5839 A-112279544* N/A High Closed-source component CVE-2018-13904 A-119050566* N/A High Closed-source component" [1] MITIGATION Android users are advised to update to the latest release available to address these vulnerabilities. [1] REFERENCES [1] Android Security Bulletin - February 2019 https://source.android.com/security/bulletin/2019-02-01.html AusCERT has made every effort to ensure that the information contained in this document is accurate. However, the decision to use the information described is the responsibility of each user or organisation. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXFj57GaOgq3Tt24GAQgZaQ//QtSSZLm3SZDZApWSj9/5SH8ivM0qTaCH wcmFYaXzEMJWLEUX1gku0HRuomuEZr1jWG4tOmeqPylDmDP8iYwud0t+bvgCdogy HndHkbbFRBTtkqfkBNwkbzsyUDQFhIs83OXf63B/a/jHPnQKImr33vYY5kVSzDnG pMYniSHJpwfCHBtEVxP4+yPzc8+N9KWYoAT6ZU/PwMOZb1sJUazze5ubdoJApAOX PskOYRTN3E4c5UNpH7pPaUbb+AWlnmZAN06+7jhdz47ZjD1BPV4VTZseprbTljcR jXuNvfrFe3CR5VcMn/wG4BEG/qUYyZQmTW6UvK5wp89qcFCN9x3mFqXc6T3OKWeQ rAGh86S/K9Fw3RdHyZMMhgo1Qql7hgHvNoC+IHpqzdOOHW1PUYsBI7d7ZqZ1YDdT vEr0UruKj37ye+ThiPr6S527AXchUEEPPnd2IAYlgMiUerF9JUHYZkiRN6SqTZ4k M0ZEFiYWJTC7EaXx1PVnK5DZ98U0raRNv9V8JtSDNWJL11DNcppmhItpF6Vw0dSJ dzhNChrOYWVGqwQdGUihLYCBLSdbCVtj61tXj25RuXhOGza1ENzwhUCz4SraqzBB OWbZeflbclLuZ47cQEeZ72h/399HX0hk6oCnqfJ8tkPYqSWKzFdQNwHazoLbxTEL WVuSRhZnbj0= =Sbdp -----END PGP SIGNATURE-----