CVE-2011-2357

Cross-application scripting vulnerability in the Browser URL loading functionality in Android 2.3.4 and 3.1 allows local applications to bypass the sandbox and execute arbitrary Javascript in arbitrary domains by (1) causing the MAX_TAB number of tabs to be opened, then loading a URI to the targeted domain into the current tab, or (2) making two startActivity function calls beginning with the targeted domain's URI followed by the malicious Javascript while the UI focus is still associated with the targeted domain.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://securitytracker.com/id?1025881
http://seclists.org/fulldisclosure/2011/Aug/9	Exploit Patch
http://blog.watchfire.com/wfblog/2011/08/android-browser-cross-application-scripting-cve-2011-2357.html	Exploit
http://blog.watchfire.com/files/advisory-android-browser.pdf	Exploit
http://secunia.com/advisories/45457	Vendor Advisory
http://android.git.kernel.org/?p=platform/packages/apps/Browser.git;%20a=commit;h=096bae248453abe83cbb2e5a2c744bd62cdb620b	Patch
http://www.infsec.cs.uni-saarland.de/projects/android-vuln/	Exploit
http://android.git.kernel.org/?p=platform/cts.git;a=commit;h=7e48fb87d48d27e65942b53b7918288c8d740e17	Patch
http://android.git.kernel.org/?p=platform/packages/apps/Browser.git;%20a=commit;h=afa4ab1e4c1d645e34bd408ce04cadfd2e5dae1e	Patch
http://www.infsec.cs.uni-saarland.de/projects/android-vuln/android_xss.pdf	Exploit
http://www.securityfocus.com/bid/48954	Exploit
http://osvdb.org/74260
http://securityreason.com/securityalert/8335
https://exchange.xforce.ibmcloud.com/vulnerabilities/68937
http://www.securityfocus.com/archive/1/519146/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:google:android:3.1:::::::*
	cpe:2.3:o:google:android:2.3.4:::::::*

Information

Published : 2011-08-12 11:55

Updated : 2018-10-09 12:32

NVD link : CVE-2011-2357

Mitre link : CVE-2011-2357

JSON object : View

CWE

CWE-20

Improper Input Validation

Advertisement

Products Affected

google

android

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://securitytracker.com/id?1025881", "name": "1025881", "tags": [], "refsource": "SECTRACK"}, {"url": "http://seclists.org/fulldisclosure/2011/Aug/9", "name": "20110802 Android Browser Cross-Application Scripting (CVE-2011-2357)", "tags": ["Exploit", "Patch"], "refsource": "FULLDISC"}, {"url": "http://blog.watchfire.com/wfblog/2011/08/android-browser-cross-application-scripting-cve-2011-2357.html", "name": "http://blog.watchfire.com/wfblog/2011/08/android-browser-cross-application-scripting-cve-2011-2357.html", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://blog.watchfire.com/files/advisory-android-browser.pdf", "name": "http://blog.watchfire.com/files/advisory-android-browser.pdf", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://secunia.com/advisories/45457", "name": "45457", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://android.git.kernel.org/?p=platform/packages/apps/Browser.git;%20a=commit;h=096bae248453abe83cbb2e5a2c744bd62cdb620b", "name": "http://android.git.kernel.org/?p=platform/packages/apps/Browser.git;%20a=commit;h=096bae248453abe83cbb2e5a2c744bd62cdb620b", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://www.infsec.cs.uni-saarland.de/projects/android-vuln/", "name": "http://www.infsec.cs.uni-saarland.de/projects/android-vuln/", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://android.git.kernel.org/?p=platform/cts.git;a=commit;h=7e48fb87d48d27e65942b53b7918288c8d740e17", "name": "http://android.git.kernel.org/?p=platform/cts.git;a=commit;h=7e48fb87d48d27e65942b53b7918288c8d740e17", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://android.git.kernel.org/?p=platform/packages/apps/Browser.git;%20a=commit;h=afa4ab1e4c1d645e34bd408ce04cadfd2e5dae1e", "name": "http://android.git.kernel.org/?p=platform/packages/apps/Browser.git;%20a=commit;h=afa4ab1e4c1d645e34bd408ce04cadfd2e5dae1e", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://www.infsec.cs.uni-saarland.de/projects/android-vuln/android_xss.pdf", "name": "http://www.infsec.cs.uni-saarland.de/projects/android-vuln/android_xss.pdf", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/48954", "name": "48954", "tags": ["Exploit"], "refsource": "BID"}, {"url": "http://osvdb.org/74260", "name": "74260", "tags": [], "refsource": "OSVDB"}, {"url": "http://securityreason.com/securityalert/8335", "name": "8335", "tags": [], "refsource": "SREASON"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68937", "name": "android-sandbox-cas(68937)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/519146/100/0/threaded", "name": "20110802 Android Browser Cross-Application Scripting (CVE-2011-2357)", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-application scripting vulnerability in the Browser URL loading functionality in Android 2.3.4 and 3.1 allows local applications to bypass the sandbox and execute arbitrary Javascript in arbitrary domains by (1) causing the MAX_TAB number of tabs to be opened, then loading a URI to the targeted domain into the current tab, or (2) making two startActivity function calls beginning with the targeted domain's URI followed by the malicious Javascript while the UI focus is still associated with the targeted domain."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-20"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2011-2357", "ASSIGNER": "security@google.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2011-08-12T18:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:google:android:3.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:google:android:2.3.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-09T19:32Z"}