Multiple Vulnerabilities in Google Android OS Could Allow for Remote Code Execution

ITS Advisory Number: 
2017-053
Date(s) Issued: 
Tuesday, June 6, 2017
Subject: 
Multiple Vulnerabilities in Google Android OS Could Allow for Remote Code Execution
Overview: 

Multiple vulnerabilities have been discovered in the Google Android operating system (OS), the most severe of which could allow for remote code execution. Android is an operating system developed by Google for mobile devices, including, but not limited to, smartphones, tablets, and watches. These vulnerabilities could be exploited through multiple methods such as email, web browsing, and MMS when processing media files. Successful exploitation of the most severe of these vulnerabilities could result in remote code execution in the context of the application. Depending on the privileges associated with this application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.

Systems Affected: 
  • Android OS builds utilizing Security Patch Levels prior to June 1, 2017

RISK
GOVERNMENT
Large and medium government entities: 
High
Small government entities: 
High
BUSINESS
Large and medium business entities: 
High
Small business entities: 
High
Home Users: 
High
Description: 

Multiple vulnerabilities have been discovered in the Google Android OS, the most severe of which could allow for remote code execution. These vulnerabilities are as follows:

  • Multiple vulnerabilities in Qualcomm closed-source components. (CVE-2014-9960, CVE-2014-9961, CVE-2014-9953, CVE-2014-9967, CVE-2015-9026, CVE-2015-9027, CVE-2015-9008, CVE-2015-9009, CVE-2015-9010, CVE-2015-9011, CVE-2015-9024, CVE-2015-9012, CVE-2015-9013, CVE-2015-9014, CVE-2015-9015, CVE-2015-9029, CVE-2016-10338, CVE-2016-10336, CVE-2016-10333, CVE-2016-10341, CVE-2016-10335, CVE-2016-10340, CVE-2016-10334, CVE-2016-10339, CVE-2016-10298, CVE-2016-10299, CVE-2014-9954, CVE-2014-9955, CVE-2014-9956, CVE-2014-9957, CVE-2014-9958, CVE-2014-9962, CVE-2014-9963, CVE-2014-9959, CVE-2014-9964, CVE-2014-9965, CVE-2014-9966, CVE-2015-9023, CVE-2015-9020, CVE-2015-9021, CVE-2015-9025, CVE-2015-9022, CVE-2015-9028, CVE-2015-9031, CVE-2015-9032, CVE-2015-9033, CVE-2015-9030, CVE-2016-10332, CVE-2016-10337, CVE-2016-10342)

  • Multiple remote code execution vulnerabilities in Libraries. (CVE-2015-8871, CVE-2016-4658, CVE-2016-5131, CVE-2016-8332, CVE-2017-0663, CVE-2017-5056, CVE-2017-7375, CVE-2017-7376)

  • A remote code execution vulnerability in Media Framework. (CVE-2017-0637)

  • A remote code execution vulnerability in System UI. (CVE-2017-0638)

  • A remote code execution vulnerability in Qualcomm components. (CVE-2017-7371)

  • Multiple elevation of privilege vulnerabilities in Qualcomm components. (CVE-2016-5861, CVE-2016-5864, CVE-2017-6421, CVE-2017-7364, CVE-2017-7365, CVE-2017-7366, CVE-2017-7367, CVE-2017-7368, CVE-2017-7369, CVE-2017-7370, CVE-2017-7372, CVE-2017-7373, CVE-2017-8233, CVE-2017-8234, CVE-2017-8235, CVE-2017-8236, CVE-2017-8237, CVE-2017-8242)

  • Multiple elevation of privilege vulnerabilities in MediaTek components. (CVE-2017-0636, CVE-2017-0649)

  • An elevation of privilege vulnerability in Synaptics components. (CVE-2017-0650)

  • Multiple elevation of privilege vulnerabilities in nVidia components. (CVE-2017-6247, CVE-2017-6248)

  • An elevation of privilege vulnerability in Bluetooth. (CVE-2017-6045)

  • An elevation of privilege vulnerability in Kernel components. (CVE-2017-0648)

  • Multiple information disclosure vulnerabilities in Qualcomm components. (CVE-2017-8239, CVE-2017-8240, CVE-2017-8241)

  • Multiple information disclosure vulnerabilities in Bluetooth. (CVE-2017-0639, CVE-2017-0646)

  • An information disclosure vulnerability in Kernel components. (CVE-2017-0651)

  • Multiple information disclosure vulnerabilities in Libraries. (CVE-2017-0647, CVE-2015-7995)

  • Multiple denial of service vulnerabilities in Media Framework. (CVE-2017-0391, CVE-2017-0640, CVE-2017-0641, CVE-2017-0642, CVE-2017-0643, CVE-2017-0644)

  • A denial of service vulnerability in Libraries. (CVE-2016-1839)

Successful exploitation of the most severe of these vulnerabilities could result in remote code execution in the context of the application. Depending on the privileges associated with this application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.

Actions: 
  • After appropriate testing, immediately apply patches provided by Google to vulnerable systems.

  • Remind users to download apps only from trusted vendors in the Play Store.

  • Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources.

  • Inform and educate users regarding the threats posed by hypertext links contained in emails or attachments especially from un-trusted sources.

References: 

Google:

https://source.android.com/security/bulletin/2017-06-01

CVE:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9953

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9954

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9955

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9956

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9957

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9958

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9959

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9960

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9961

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9962

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9963

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9964

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9965

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9966

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9967

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7995

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8871

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9008

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9009

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9010

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9011

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9012

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9013

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9014

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9015

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9020

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9021  

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9022

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9023

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9024

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9025

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9026

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9027

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9028

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9029

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9030

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9031

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9032

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9033

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10298

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10299

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10332

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10333

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10334

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10335

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10336

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10337

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10338

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10339

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10340

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10341

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10342

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1839

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4658

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5131

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5861

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5864

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8332

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0391

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0636

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0637

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0638

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0639

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0640

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0641

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0642

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0643

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0644

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0645

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0646

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0647

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0648

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0649

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0650

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0651

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0663

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5056

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6247

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6248

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6421

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7364

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7365

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7366

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7367

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7368

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7369

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7370

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7371

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7372

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7373

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7375

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7376

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8233

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8234

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8235

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8236   

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8237

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8239

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8240

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8241

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8242