Issue #1257: Installer Hijacking vulnerability - Replicant

Actions

Copy link

Issue #1257

closed

Installer Hijacking vulnerability

Added by My Self over 9 years ago. Updated about 9 years ago.

Status:

Closed

Priority:

High

Assignee:

My Self

Category:

Security

Target version:

Any version

Start date:

03/30/2015

Due date:

% Done:

100%

Estimated time:

Resolution:

fixed

Device:

Grant:

Type of work:

Description

I've checked, that Replicant is vulnerable to the Installer Hijacking vulnerability.
More informations: http://researchcenter.paloaltonetworks.com/2015/03/android-installer-hijacking-vulnerability-could-expose-android-users-to-malware/

Solution/Patch
Android diff: https://android.googlesource.com/platform/packages/apps/PackageInstaller/+/2b3202c3ff18469b294629bf1416118f12492173

Files

Add-manifest-to-verification-params.patch (4.99 KB) Add-manifest-to-verification-params.patch

My Self, 08/26/2015 11:38 AM

Actions

Copy link

Updated by My Self over 9 years ago

I have to wait until the Replicant sources are fetchable again:
http://redmine.replicant.us/boards/15/topics/8817

Actions

Copy link

Updated by My Self about 9 years ago

File Add-manifest-to-verification-params.patch added

The sources are up again.
So I decided to attach the patch listed above, (and tested with the current Replicant 4.2 sources) on this ticket.
After flashing the patched Replicant, I've tested my productive device several days without any misbehavior.
Furthermore I've successfully checked, that Replicant isn't vulnerale to the "Installer Hijacking Vulnerability" anymore.

@everyone: please review the patch and apply it if you like.

Actions

Copy link