[Japanese]

JVNDB-2013-000111

Android OS vulnerable to arbitrary Java method execution

Overview

Android OS contains a vulnerability where an arbitrary Java method may be executed.

Tamami Eguchi reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V2 Severity:
Base Metrics 6.8 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: Partial
Affected Products


Google
  • Android OS version 3.0 through 4.1.x

Impact

When viewing a specially crafted page using the standard Android browser or an other application that uses the WebView class, Android OS may be rebooted or arbitrary code may be executed without intent from the user.
Solution

[Apply an Update]
Update your device according to the information provided by the provider or developer.
Vendor Information

KDDI eAccess Ltd. SoftBank Disney Mobile on SoftBank NTT DOCOMO, INC.
CWE (What is CWE?)

  1. No Mapping(CWE-DesignError) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2013-4710
References

  1. JVN : JVN#53768697
  2. National Vulnerability Database (NVD) : CVE-2013-4710
Revision History

  • [2013/12/17]
      Web page was published
    [2014/03/05]
      References : Content was added

Date Public2013/12/17
Date First Published2013/12/17
Date Last Updated2014/03/05