Google Mitigates Android Security Woes

Thursday, April 7, 2016 @ 05:04 PM gHale


Google fixed 40 Android security bugs, 15 of which reached the company’s highest security rating of critical.

The most important change was security flaw found in Android devices running versions 4.4.4 and higher, and it would have allowed attackers to root the device, even permanently compromising it.

RELATED STORIES
Android App Hole Reveals Data
Android Hole gets Emergency Patch
New Stagefright Exploit Hits Android, Again
Trojan Focuses on Android

The updates released in the Nexus Security Bulletin, Android’s de-facto security update.

Researchers said the most severe of these issues is a critical security vulnerability that could enable remote code execution (RCE) on an affected device through multiple methods such as email, web browsing, and MMS when processing media files.

Android Security Advisory 2016-03-18 previously discussed use of CVE-2015-1805 by a rooting application. CVE-2015-1805 is resolved in this update. There have been no reports of active customer exploitation or abuse of the other newly reported issues, the researchers said.

A quick patch shipped to OEMs back in March, and now Google is delivering a better fix to prevent future exploitation.

Besides this, Google also addressed multiple RCE bugs in the DHCPCD service, in the Media Codec, and the almost standard monthly RCE fixes to the Mediaserver component and libstagefright library.

Additional patches for two other elevation of privilege issues rated as critical were also for the Android Kernel and the Qualcomm Performance Module.

In addition, there was a bug in the DHCPCD component, which allows malicious apps to leverage its deep integration with various internal Android features and execute code on unpatched devices within the context of the DHCP client, which most apps don’t have.