CVE-2011-2344: Critical severity Google Android vulnerability
Android Picasa in Android 3.0 and 2.x through 2.3.4 uses a cleartext HTTP session when transmitting the authToken obtained from ClientLogin, which allows remote attackers to gain privileges and access private pictures and web albums by sniffing the token from connections with picasaweb.google.com.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2344?
The severity of CVE-2011-2344 is classified as high due to the risk of unauthorized access to private pictures and web albums.
How do I fix CVE-2011-2344?
To fix CVE-2011-2344, update to a version of Android that does not use cleartext HTTP for transmitting authTokens.
What are the impacts of CVE-2011-2344?
CVE-2011-2344 allows remote attackers to sniff the authToken, potentially granting them access to private data in Picasa.
Which Android versions are affected by CVE-2011-2344?
CVE-2011-2344 affects Android versions 2.1, 2.2, 2.3, and 3.0.
Is it safe to use affected Android versions with Picasa?
Using affected Android versions with Picasa is not safe due to the risk of exposure of private data.