AndroidVulnerabilities.org

keystore buffer

(json)

• CVE numbers: CVE-2014-3100 [securityinteligence-keystore]
• Coordinated disclosure?: true
• Categories: system
• Details: Stack-based buffer overflow in the encode_key function in /system/bin/keystore in the KeyStore service in Android 4.3 allows attackers to execute arbitrary code, and consequently obtain sensitive key information or bypass intended restrictions on cryptographic operations, via a long key name. [CVE-2014-3100]
• Discovered by: Roee Hay (IBM) [securityinteligence-keystore] on: 2013-09-09 [keystore-patch]
• Reported on: 2014-06-23 [securityinteligence-keystore]
• Fixed on: 2013-09-09 [keystore-patch]
• Fix released on: 2013-10-31 [android-4.4-release]
• Affected versions: 4.3 [securityinteligence-keystore] regex: 4.3.[0-9]
• Affected devices: all [securityinteligence-keystore]
• Affected manufacturers: all [securityinteligence-keystore]
• Fixed versions: 4.4 [keystore-patch]
• Submission: by: Daniel R. Thomas, on: 2014-07-17; by: Laurent Simon, on: 2014-06-24