Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT Security Bulletin
ASB-2019.0046
Android Security Bulletin - February 2019
5 February 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Android
Operating System: Android
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Increased Privileges -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2019-2001 CVE-2019-2000 CVE-2019-1999
CVE-2019-1998 CVE-2019-1997 CVE-2019-1996
CVE-2019-1995 CVE-2019-1994 CVE-2019-1993
CVE-2019-1992 CVE-2019-1991 CVE-2019-1988
CVE-2019-1987 CVE-2019-1986 CVE-2018-13905
CVE-2018-13904 CVE-2018-13900 CVE-2018-11948
CVE-2018-11945 CVE-2018-11938 CVE-2018-11935
CVE-2018-11932 CVE-2018-11931 CVE-2018-11921
CVE-2018-11864 CVE-2018-11845 CVE-2018-11820
CVE-2018-11289 CVE-2018-11280 CVE-2018-11275
CVE-2018-11268 CVE-2018-11262 CVE-2018-10879
CVE-2018-6271 CVE-2018-6268 CVE-2018-6267
CVE-2018-5839 CVE-2018-5269 CVE-2018-5268
CVE-2017-18009 CVE-2017-17760 CVE-2016-6684
Member content until: Thursday, March 7 2019
Reference: ESB-2018.2124
ESB-2018.1195
ASB-2016.0093
OVERVIEW
Multiple security vulnerabilities have been identified in the Android
operating system prior to the 2019-02-01 patch level. [1]
IMPACT
"Framework
The most severe vulnerability in this section could enable a remote
attacker using a specially crafted PNG file to execute arbitrary code
within the context of a privileged process.
CVE References Type Severity Updated AOSP versions
CVE-2019-1986 A-117838472 RCE Critical 9
CVE-2019-1987 A-118143775 RCE Critical 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9
CVE-2019-1988 A-118372692 RCE Critical 8.0, 8.1, 9
Library
The most severe vulnerability in this section could enable a remote
attacker using a specially crafted file to execute arbitrary code
within the context of an unprivileged process.
CVE References Type Severity Updated AOSP versions
CVE-2017-17760 A-78029030* RCE High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9
CVE-2018-5268 A-78029634* RCE High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9
CVE-2018-5269 A-78029727* RCE High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9
CVE-2017-18009 A-78026242* ID Moderate 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9
System
The most severe vulnerability in this section could enable a remote
attacker using a specially crafted transmission to execute arbitrary
code within the context of a privileged process.
CVE References Type Severity Updated AOSP versions
CVE-2019-1991 A-110166268 RCE Critical 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9
CVE-2019-1992 A-116222069 RCE Critical 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9
CVE-2019-1993 A-119819889 EoP High 8.0, 8.1, 9
CVE-2019-1994 A-117770924 EoP High 8.0, 8.1, 9
CVE-2019-1995 A-32589229 ID High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9
CVE-2019-1996 A-111451066 ID High 8.0, 8.1, 9
CVE-2019-1997 A-117508900 ID High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9
CVE-2019-1998 A-116055338 DoS High 9
2019-02-05 security patch level vulnerability details
In the sections below, we provide details for each of the security
vulnerabilities that apply to the 2019-02-05 patch level.
Vulnerabilities are grouped under the component they affect and
include details such as the CVE, associated references, type of
vulnerability, severity, component (where applicable), and updated
AOSP versions (where applicable). When available, we link the public
change that addressed the issue to the bug ID, such as the AOSP change
list. When multiple changes relate to a single bug, additional
references are linked to numbers following the bug ID.
Kernel components
The most severe vulnerability in this section could enable a local
malicious application to execute arbitrary code within the context of
a privileged process.
CVE References Type Severity Component
CVE-2018-10879 A-116406063 EoP High ext4 filesystem
Upstream kernel
CVE-2019-1999 A-120025196* EoP High Binder driver
CVE-2019-2000 A-120025789* EoP High Binder driver
CVE-2019-2001 A-117422211* ID High iomem
NVIDIA components
The most severe vulnerability in this section could enable a remote
attacker using a specially crafted file to execute arbitrary code
within the context of a privileged process.
CVE References Type Severity Component
CVE-2018-6271 A-80198474* RCE Critical libnvomx
CVE-2018-6267 A-70857947* EoP High libnvomx
CVE-2018-6268 A-80433161* EoP High libnvomx
CVE-2016-6684 A-117423758* ID High kernel log
Qualcomm components
These vulnerabilities affect Qualcomm components and are described in
further detail in the appropriate Qualcomm security bulletin or
security alert. The severity assessment of these issues is provided
directly by Qualcomm.
CVE References Type Severity Component
CVE-2018-11262 A-76424945 N/A Critical bootloader
QC-CR#2221192
CVE-2018-11280 A-109741776 N/A High Modem
QC-CR#2185061
CVE-2018-11275 A-74409078 N/A High Bootloader
QC-CR#2221256
CVE-2018-13900 A-119052051 N/A High Modem
QC-CR#2287499
CVE-2018-13905 A-119052050 N/A High Graphics
QC-CR#2225202
Qualcomm closed-source components
These vulnerabilities affect Qualcomm components and are described in
further detail in the appropriate Qualcomm security bulletin or
security alert. The severity assessment of these issues is provided
directly by Qualcomm.
CVE References Type Severity Component
CVE-2018-11289 A-109678453* N/A Critical Closed-source component
CVE-2018-11820 A-111089815* N/A Critical Closed-source component
CVE-2018-11938 A-112279482* N/A Critical Closed-source component
CVE-2018-11945 A-112278875* N/A Critical Closed-source component
CVE-2018-11268 A-109678259* N/A High Closed-source component
CVE-2018-11845 A-111088838* N/A High Closed-source component
CVE-2018-11864 A-111092944* N/A High Closed-source component
CVE-2018-11921 A-112278972* N/A High Closed-source component
CVE-2018-11931 A-112279521* N/A High Closed-source component
CVE-2018-11932 A-112279426* N/A High Closed-source component
CVE-2018-11935 A-112279483* N/A High Closed-source component
CVE-2018-11948 A-112279144* N/A High Closed-source component
CVE-2018-5839 A-112279544* N/A High Closed-source component
CVE-2018-13904 A-119050566* N/A High Closed-source component" [1]
MITIGATION
Android users are advised to update to the latest release available
to address these vulnerabilities. [1]
REFERENCES
[1] Android Security Bulletin - February 2019
https://source.android.com/security/bulletin/2019-02-01.html
AusCERT has made every effort to ensure that the information contained
in this document is accurate. However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXFj57GaOgq3Tt24GAQgZaQ//QtSSZLm3SZDZApWSj9/5SH8ivM0qTaCH
wcmFYaXzEMJWLEUX1gku0HRuomuEZr1jWG4tOmeqPylDmDP8iYwud0t+bvgCdogy
HndHkbbFRBTtkqfkBNwkbzsyUDQFhIs83OXf63B/a/jHPnQKImr33vYY5kVSzDnG
pMYniSHJpwfCHBtEVxP4+yPzc8+N9KWYoAT6ZU/PwMOZb1sJUazze5ubdoJApAOX
PskOYRTN3E4c5UNpH7pPaUbb+AWlnmZAN06+7jhdz47ZjD1BPV4VTZseprbTljcR
jXuNvfrFe3CR5VcMn/wG4BEG/qUYyZQmTW6UvK5wp89qcFCN9x3mFqXc6T3OKWeQ
rAGh86S/K9Fw3RdHyZMMhgo1Qql7hgHvNoC+IHpqzdOOHW1PUYsBI7d7ZqZ1YDdT
vEr0UruKj37ye+ThiPr6S527AXchUEEPPnd2IAYlgMiUerF9JUHYZkiRN6SqTZ4k
M0ZEFiYWJTC7EaXx1PVnK5DZ98U0raRNv9V8JtSDNWJL11DNcppmhItpF6Vw0dSJ
dzhNChrOYWVGqwQdGUihLYCBLSdbCVtj61tXj25RuXhOGza1ENzwhUCz4SraqzBB
OWbZeflbclLuZ47cQEeZ72h/399HX0hk6oCnqfJ8tkPYqSWKzFdQNwHazoLbxTEL
WVuSRhZnbj0=
=Sbdp
-----END PGP SIGNATURE-----